PatchSiren cyber security CVE debrief

CVE-2026-36811 Shenzhen Tenda Technology Co., Ltd CVE debrief

A buffer overflow vulnerability was discovered in the picName parameter of the formDelwebAuthPic function in Tenda W15E v15.11.0.10. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted HTTP request. The vulnerability has a CVSS score of 7.5 and a severity of HIGH.

Vendor: Shenzhen Tenda Technology Co., Ltd
Product: Tenda W15E v15.11.0.10
CVSS: HIGH 7.5
CISA KEV: Not listed in stored evidence
Original CVE published: 2026-06-09
Original CVE updated: 2026-06-10
Advisory published: 2026-06-09
Advisory updated: 2026-06-10

Who should care

Users of Tenda W15E v15.11.0.10

Technical summary

The CVE-2026-36811 vulnerability is a buffer overflow in the picName parameter of the formDelwebAuthPic function in Tenda W15E v15.11.0.10. This vulnerability can be exploited by sending a crafted HTTP request, potentially leading to a Denial of Service (DoS).

Defensive priority

HIGH

Recommended defensive actions

Apply patches or updates provided by the vendor to fix the buffer overflow vulnerability.
Restrict access to the affected function to only trusted users and networks.
Monitor network traffic for suspicious activity.

Evidence notes

The vulnerability was discovered in the wild and reported to CVE.org.

Official resources

CVE-2026-36811 was published on 2026-06-09T19:17:46.873Z and modified on 2026-06-10T20:17:13.320Z.