CVE-2026-19823
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk38th percentile - higher than 38% of all known CVEs
Summary
A stack-based buffer overflow vulnerability was discovered in Tenda W20E 15.11.0.6(1068_1546_841)_CN_TDC in the formQOSRuleDel function of /goform/delQos. Manipulating the qosIndex argument results in buffer overflow. The attack can be executed remotely, and the exploit is publicly available.
Risk Assessment
Potential for remote code execution or device crash, potentially allowing an attacker to take control of the router and disrupt network operations.
Recommendation
Install available firmware updates and restrict administrative panel access to trusted networks only.
Other vulnerabilities in Tenda W20E
See all- CVE-2026-67967Critical
A buffer overflow vulnerability in Tenda W20E V16.01.0.6(2782) allows an attacker to execute arbitrary code. This is an incomplete fix for CVE-2025-44867 and CVE-2026-36819.
- CVE-2026-67966Critical
The /goform/telnet endpoint in Tenda W20E V16.01.0.6(2782) allows unauthenticated remote attackers to activate the Telnet daemon and obtain root shell access.
- CVE-2026-67965Critical
An issue in Tenda W20E v.16.01.0.6(2782) allows a remote attacker to execute arbitrary code via the url_need_login function.
- CVE-2026-90689High
A security flaw has been discovered in Tenda W20E 15.11.0.61068_1546_841_CN_TDC in the formDelWebAuthWhiteUser function. Manipulation of the webAuthWhiteUserIndex argument results in a stack-based buffer overflow. The attack can be initiated remotely.
- CVE-2026-90688Medium
In Tenda W20E 15.11.0.61068_1546_841_CN_TDC, the formIPMacBindAdd function of the HTTP Handler component mishandles the IPMacBindRule argument, leading to a stack-based buffer overflow. The attack can be launched remotely.
- CVE-2026-19824High
A stack-based buffer overflow vulnerability was identified in Tenda W20E 15.11.0.6(1068_1546_841)_CN_TDC in the ipMacBindListStore function of /goform/addIpMacBind. Manipulating the IPMacBindRule argument can lead to buffer overflow. The attack can be executed remotely, and the exploit is publicly available.
- CVE-2026-19822High
A vulnerability was identified in Tenda W20E 15.11.0.6(1068_1546_841)_CN_TDC. The function lstAdd of the file /goform/editQos in the QoS Edit component is affected. Manipulation of the argument qosListConnecttedNum leads to stack-based buffer overflow. The attack may be launched remotely, and the exploit is publicly available.
- CVE-2026-36823High
A buffer overflow vulnerability was discovered in the webAuthUserInfo parameter of the formAddWebAuthUser function in Tenda W20E router version 15.11.0.6. Attackers can cause a Denial of Service (DoS) via a crafted HTTP request.
- CVE-2026-36822High
A buffer overflow vulnerability was discovered in the macAddr parameter of the formDelStaState function in Tenda W20E router version 15.11.0.6. Attackers can cause a Denial of Service (DoS) via a crafted HTTP request.
- CVE-2026-36821High
A buffer overflow vulnerability was discovered in the picCropName parameter of the formCropAndSetWewifiPic function in Tenda W20E router version 15.11.0.6. Attackers can cause a Denial of Service (DoS) via a crafted HTTP request.
Original NVD description (English source)
A security flaw has been discovered in Tenda W20E 15.11.0.6(1068_1546_841)_CN_TDC. Impacted is the function formQOSRuleDel of the file /goform/delQos of the component QoS Rule Deletion. Performing a manipulation of the argument qosIndex results in stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS