CVE-2026-11522
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk38th percentile - higher than 38% of all known CVEs
Summary
A stack-based buffer overflow vulnerability has been detected in Tenda W20E version 15.11.0.6 in the formSetPortMirror function of the /goform/setPortMirror file. Manipulation of the portMirrorMirroredPorts argument leads to buffer overflow. The attack can be initiated remotely and the exploit is public.
Risk Assessment
Remote exploitation could allow arbitrary code execution on the router, potentially leading to device compromise and network security breach.
Recommendation
Update the Tenda W20E firmware to the latest version as soon as possible, or restrict management interface access to trusted networks only.
Other vulnerabilities in Tenda W20E
See all- CVE-2026-67967Critical
A buffer overflow vulnerability in Tenda W20E V16.01.0.6(2782) allows an attacker to execute arbitrary code. This is an incomplete fix for CVE-2025-44867 and CVE-2026-36819.
- CVE-2026-67966Critical
The /goform/telnet endpoint in Tenda W20E V16.01.0.6(2782) allows unauthenticated remote attackers to activate the Telnet daemon and obtain root shell access.
- CVE-2026-67965Critical
An issue in Tenda W20E v.16.01.0.6(2782) allows a remote attacker to execute arbitrary code via the url_need_login function.
- CVE-2026-19824High
A stack-based buffer overflow vulnerability was identified in Tenda W20E 15.11.0.6(1068_1546_841)_CN_TDC in the ipMacBindListStore function of /goform/addIpMacBind. Manipulating the IPMacBindRule argument can lead to buffer overflow. The attack can be executed remotely, and the exploit is publicly available.
- CVE-2026-19823High
A stack-based buffer overflow vulnerability was discovered in Tenda W20E 15.11.0.6(1068_1546_841)_CN_TDC in the formQOSRuleDel function of /goform/delQos. Manipulating the qosIndex argument results in buffer overflow. The attack can be executed remotely, and the exploit is publicly available.
- CVE-2026-19822High
A vulnerability was identified in Tenda W20E 15.11.0.6(1068_1546_841)_CN_TDC. The function lstAdd of the file /goform/editQos in the QoS Edit component is affected. Manipulation of the argument qosListConnecttedNum leads to stack-based buffer overflow. The attack may be launched remotely, and the exploit is publicly available.
- CVE-2026-36823High
A buffer overflow vulnerability was discovered in the webAuthUserInfo parameter of the formAddWebAuthUser function in Tenda W20E router version 15.11.0.6. Attackers can cause a Denial of Service (DoS) via a crafted HTTP request.
- CVE-2026-36822High
A buffer overflow vulnerability was discovered in the macAddr parameter of the formDelStaState function in Tenda W20E router version 15.11.0.6. Attackers can cause a Denial of Service (DoS) via a crafted HTTP request.
- CVE-2026-36821High
A buffer overflow vulnerability was discovered in the picCropName parameter of the formCropAndSetWewifiPic function in Tenda W20E router version 15.11.0.6. Attackers can cause a Denial of Service (DoS) via a crafted HTTP request.
- CVE-2026-36820High
A buffer overflow vulnerability was discovered in the webAuthWhiteUserInfo parameter of the formAddWebAuthWhiteUser function in Tenda W20E firmware version 15.11.0.6. This flaw allows attackers to cause a Denial of Service (DoS) via a crafted HTTP request.
Original NVD description (English source)
A vulnerability was detected in Tenda W20E 15.11.0.6. This vulnerability affects the function formSetPortMirror of the file /goform/setPortMirror. Performing a manipulation of the argument portMirrorMirroredPorts results in stack-based buffer overflow. The attack can be initiated remotely. The exploit is now public and may be used.