CVE-2026-67966

A buffer overflow vulnerability in Tenda W20E V16.01.0.6(2782) allows an attacker to execute arbitrary code. This is an incomplete fix for CVE-2025-44867 and CVE-2026-36819.

An issue in Tenda W20E v.16.01.0.6(2782) allows a remote attacker to execute arbitrary code via the url_need_login function.

A security flaw has been discovered in Tenda W20E 15.11.0.61068_1546_841_CN_TDC in the formDelWebAuthWhiteUser function. Manipulation of the webAuthWhiteUserIndex argument results in a stack-based buffer overflow. The attack can be initiated remotely.

In Tenda W20E 15.11.0.61068_1546_841_CN_TDC, the formIPMacBindAdd function of the HTTP Handler component mishandles the IPMacBindRule argument, leading to a stack-based buffer overflow. The attack can be launched remotely.

A stack-based buffer overflow vulnerability was identified in Tenda W20E 15.11.0.6(1068_1546_841)_CN_TDC in the ipMacBindListStore function of /goform/addIpMacBind. Manipulating the IPMacBindRule argument can lead to buffer overflow. The attack can be executed remotely, and the exploit is publicly available.

A stack-based buffer overflow vulnerability was discovered in Tenda W20E 15.11.0.6(1068_1546_841)_CN_TDC in the formQOSRuleDel function of /goform/delQos. Manipulating the qosIndex argument results in buffer overflow. The attack can be executed remotely, and the exploit is publicly available.

A vulnerability was identified in Tenda W20E 15.11.0.6(1068_1546_841)_CN_TDC. The function lstAdd of the file /goform/editQos in the QoS Edit component is affected. Manipulation of the argument qosListConnecttedNum leads to stack-based buffer overflow. The attack may be launched remotely, and the exploit is publicly available.

A buffer overflow vulnerability was discovered in the webAuthUserInfo parameter of the formAddWebAuthUser function in Tenda W20E router version 15.11.0.6. Attackers can cause a Denial of Service (DoS) via a crafted HTTP request.

A buffer overflow vulnerability was discovered in the macAddr parameter of the formDelStaState function in Tenda W20E router version 15.11.0.6. Attackers can cause a Denial of Service (DoS) via a crafted HTTP request.

A buffer overflow vulnerability was discovered in the picCropName parameter of the formCropAndSetWewifiPic function in Tenda W20E router version 15.11.0.6. Attackers can cause a Denial of Service (DoS) via a crafted HTTP request.