Executive Summary

CVE-2026-36817 is a buffer overflow vulnerability found in the Tenda W15E router, specifically in version V15.11.0.10. The issue exists in the function formAddWebAuthWhiteUser, which processes an HTTP parameter called webAuthWhiteUserInfo. An attacker can send a specially crafted HTTP request with an excessively long webAuthWhiteUserInfo parameter. This causes the function to copy more data than the buffer can hold, leading to a buffer overflow.

This overflow can cause the router's process to crash or become unstable, resulting in a Denial of Service (DoS) condition.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you by causing a Denial of Service (DoS) on the affected Tenda W15E router. An attacker can exploit the buffer overflow by sending a crafted HTTP request, which may crash the router's process or make the device unstable and unresponsive.

This means your network connectivity could be disrupted, potentially leading to downtime or loss of access to network resources.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by monitoring for specially crafted HTTP requests targeting the vulnerable CGI endpoint that uses the formAddWebAuthWhiteUser function. Specifically, detection involves identifying HTTP requests containing an excessively long webAuthWhiteUserInfo parameter, such as one with hundreds of repeated characters followed by newline characters.

A practical approach is to capture and analyze HTTP traffic to the Tenda W15E router, looking for requests to the addWebAuthWhiteUser action with unusually long webAuthWhiteUserInfo parameters.

Example command using tcpdump to capture HTTP traffic to the router (replace <router_ip> with the router's IP address):

• tcpdump -A -s 0 host <router_ip> and tcp port 80

After capturing, search for HTTP POST requests containing the parameter webAuthWhiteUserInfo with suspiciously long values.

Alternatively, use tools like grep or Wireshark to filter for the parameter in captured traffic.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include restricting access to the vulnerable CGI endpoint to trusted users only, such as limiting access to the router's management interface via firewall rules or network segmentation.

Additionally, monitor and block HTTP requests containing suspiciously long webAuthWhiteUserInfo parameters to prevent exploitation attempts.

If possible, update the router firmware to a version that addresses this vulnerability once available.

Until a patch is released, consider disabling remote management features or the affected web interface components to reduce exposure.

Useful 0 Not Useful 0