Tenda W20E vulnerabilities

A buffer overflow vulnerability in Tenda W20E V16.01.0.6(2782) allows an attacker to execute arbitrary code. This is an incomplete fix for CVE-2025-44867 and CVE-2026-36819.

The /goform/telnet endpoint in Tenda W20E V16.01.0.6(2782) allows unauthenticated remote attackers to activate the Telnet daemon and obtain root shell access.

An issue in Tenda W20E v.16.01.0.6(2782) allows a remote attacker to execute arbitrary code via the url_need_login function.

A security flaw has been discovered in Tenda W20E 15.11.0.61068_1546_841_CN_TDC in the formDelWebAuthWhiteUser function. Manipulation of the webAuthWhiteUserIndex argument results in a stack-based buffer overflow. The attack can be initiated remotely.

In Tenda W20E 15.11.0.61068_1546_841_CN_TDC, the formIPMacBindAdd function of the HTTP Handler component mishandles the IPMacBindRule argument, leading to a stack-based buffer overflow. The attack can be launched remotely.

A stack-based buffer overflow vulnerability was identified in Tenda W20E 15.11.0.6(1068_1546_841)_CN_TDC in the ipMacBindListStore function of /goform/addIpMacBind. Manipulating the IPMacBindRule argument can lead to buffer overflow. The attack can be executed remotely, and the exploit is publicly available.

A stack-based buffer overflow vulnerability was discovered in Tenda W20E 15.11.0.6(1068_1546_841)_CN_TDC in the formQOSRuleDel function of /goform/delQos. Manipulating the qosIndex argument results in buffer overflow. The attack can be executed remotely, and the exploit is publicly available.

A vulnerability was identified in Tenda W20E 15.11.0.6(1068_1546_841)_CN_TDC. The function lstAdd of the file /goform/editQos in the QoS Edit component is affected. Manipulation of the argument qosListConnecttedNum leads to stack-based buffer overflow. The attack may be launched remotely, and the exploit is publicly available.

A buffer overflow vulnerability was discovered in the webAuthUserInfo parameter of the formAddWebAuthUser function in Tenda W20E router version 15.11.0.6. Attackers can cause a Denial of Service (DoS) via a crafted HTTP request.

A buffer overflow vulnerability was discovered in the macAddr parameter of the formDelStaState function in Tenda W20E router version 15.11.0.6. Attackers can cause a Denial of Service (DoS) via a crafted HTTP request.

A buffer overflow vulnerability was discovered in the picCropName parameter of the formCropAndSetWewifiPic function in Tenda W20E router version 15.11.0.6. Attackers can cause a Denial of Service (DoS) via a crafted HTTP request.

A buffer overflow vulnerability was discovered in the webAuthWhiteUserInfo parameter of the formAddWebAuthWhiteUser function in Tenda W20E firmware version 15.11.0.6. This flaw allows attackers to cause a Denial of Service (DoS) via a crafted HTTP request.

A buffer overflow vulnerability was discovered in the bindMACAddr parameter of the fromSetDhcpRules function in Tenda W20E router version 15.11.0.6. Attackers can cause a Denial of Service (DoS) via a crafted HTTP request.

A buffer overflow vulnerability was discovered in the wewifiWhiteUserInfo parameter of the formAddWewifiWhiteUser function in Tenda W20E router version 15.11.0.6. Attackers can cause a Denial of Service (DoS) via a crafted HTTP request.

Vulnerability in Tenda W20E version 15.11.0.6: stack-based buffer overflow in function modifyWifiFilterRules of file /goform/modifyWifiFilterRules (Web Management Interface component). An attacker can remotely trigger overflow via the wifiFilterListRemark argument. Exploit is publicly available.

A stack-based buffer overflow vulnerability has been found in Tenda W20E version 15.11.0.6 in the formPortalAuth function of the /goform/PortalAuth file. Manipulation of the gotoUrl argument can lead to buffer overflow. The attack can be launched remotely and the exploit is publicly available.

A stack-based buffer overflow vulnerability has been detected in Tenda W20E version 15.11.0.6 in the formSetPortMirror function of the /goform/setPortMirror file. Manipulation of the portMirrorMirroredPorts argument leads to buffer overflow. The attack can be initiated remotely and the exploit is public.