Executive Summary

CVE-2026-36822 is a buffer overflow vulnerability in the Tenda W20E router's firmware version 15.11.0.6. It occurs in the formDelStaState function when processing the macAddr parameter from an HTTP request without proper bounds checking.

An attacker can exploit this by sending a specially crafted HTTP request with an excessively long macAddr parameter, which causes a buffer overflow in the init_wl_policy_list function.

This overflow can lead to a denial of service (DoS) by crashing the process or causing device instability.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you by causing a denial of service (DoS) on the affected Tenda W20E router.

An attacker exploiting this flaw can crash the router's process or make the device unstable, potentially disrupting your network connectivity and services.

Useful 0 Not Useful 0

Compliance Impact

The provided information does not specify any direct impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by sending a crafted HTTP request to the formDelStaState CGI endpoint of the Tenda W20E router with an excessively long macAddr parameter (for example, a string of 888 or more 'a' characters followed by a comma). If the device crashes or becomes unstable, it indicates the presence of the vulnerability.

A sample command using curl to test this could be:

• curl -X POST http://<router-ip>/formDelStaState -d "macAddr=$(python3 -c 'print("a"*888 + ",")')"

Replace <router-ip> with the IP address of the target device. Monitoring the device for crashes or instability after this request can help detect the vulnerability.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include updating the Tenda W20E router firmware from the vulnerable version V15.11.0.6 to the latest available version, such as V16.01.0.6, which presumably contains a fix for this buffer overflow vulnerability.

Additionally, restricting access to the router's HTTP management interface from untrusted networks and monitoring for suspicious HTTP requests targeting the formDelStaState endpoint can help reduce the risk of exploitation.

Useful 0 Not Useful 0