CVE-2026-19822
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk46th percentile - higher than 46% of all known CVEs
Summary
A vulnerability was identified in Tenda W20E 15.11.0.6(1068_1546_841)_CN_TDC. The function lstAdd of the file /goform/editQos in the QoS Edit component is affected. Manipulation of the argument qosListConnecttedNum leads to stack-based buffer overflow. The attack may be launched remotely, and the exploit is publicly available.
Risk Assessment
A remote attacker can cause device crash or potentially execute code, disrupting network operations and compromising security.
Recommendation
Check for and apply firmware updates from the vendor, and restrict access to the device's administrative interface.
Original NVD description (English source)
A vulnerability was identified in Tenda W20E 15.11.0.6(1068_1546_841)_CN_TDC. This issue affects the function lstAdd of the file /goform/editQos of the component QoS Edit. Such manipulation of the argument qosListConnecttedNum leads to stack-based buffer overflow. The attack may be launched remotely. The exploit is publicly available and might be used.