EUVD-2026-35077
GHSA-3fr6-p7vj-gvw2
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
ReconIdentify exposed W20E admin interface
-
DeliveryObtain low-privilege web credentials
-
ExploitSend crafted POST to /goform/setPortMirror
-
InstallOverflow portMirrorMirroredPorts stack buffer
-
C2Hijack saved return address
-
ExecuteExecute shellcode as root
-
ImpactPersist on router for traffic interception
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Stack buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Attacker must reach the router's HTTP management interface (typically TCP/80 or /443 on the LAN side, and on the WAN side only if remote management is enabled) and must hold valid credentials of at least low privilege per CVSS PR:L - exploitation is not achievable fully unauthenticated. The target must be a Tenda W20E running firmware 15.11.0.6; no user interaction is required (UI:N), and the vulnerable formSetPortMirror handler at /goform/setPortMirror must be reachable, which it is by default on the administrative interface. Practical exploitation is constrained by network exposure of the admin UI and by credential strength - devices left with default credentials or with WAN-side management enabled face the highest realistic risk. |
| Impact | CVSS 4.0 scores this 7.4 (High) with vector AV:N/AC:L/AT:N/PR:L/UI:N - network-reachable, low complexity, but requiring some level of authentication (PR:L) and no user interaction, with high VC/VI/VA impact and unchanged subsequent system scope. The exploit maturity is marked E:P (proof-of-concept), and a public PoC is hosted on GitHub, so weaponization barriers are low. EPSS data and CISA KEV status were not provided, so probability of opportunistic exploitation cannot be quantified; however, Tenda SOHO devices are routinely targeted by IoT botnets, and the PR:L requirement is often trivially satisfied because default/weak credentials are common on this device class. Overall, this should be treated as a real priority for any deployment that exposes the admin interface to untrusted networks, while internal-only deployments with strong credentials carry materially lower risk. |
| Exploit ScenarioDerived | An attacker who has obtained valid (potentially low-privilege or default) credentials to the Tenda W20E web interface sends a crafted HTTP POST to /goform/setPortMirror with an oversized portMirrorMirroredPorts argument. The stack buffer overflow corrupts the saved return address in formSetPortMirror, redirecting execution to attacker-supplied shellcode and yielding command execution as root on the router, enabling traffic interception, DNS hijacking, or recruitment into an IoT botnet. A public PoC published on GitHub significantly lowers the skill required. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv3 – Jun 08, 2026
Stack-based buffer overflow in the Tenda W20E router (firmware 15.11.0.6) allows remote authenticated attackers to corrupt memory via the portMirrorMirroredPorts parameter handled by formSetPortMirror in /goform/setPortMirror. Publicly available exploit code exists, raising the practical risk for exposed management interfaces, though no CISA KEV listing or EPSS data is provided to confirm widespread exploitation. The flaw enables high impact on confidentiality, integrity, and availability of the device per the CVSS 4.0 vector.
Earlier versions of this analysis (2)
Stack-based buffer overflow in the Tenda W20E router (firmware 15.11.0.6) allows authenticated remote attackers to corrupt memory by manipulating the portMirrorMirroredPorts argument sent to the formSetPortMirror handler at /goform/setPortMirror. Publicly available exploit code exists per VulDB, raising the practical risk for exposed devices despite no current CISA KEV listing. The flaw can lead to high impact on confidentiality, integrity, and availability of the device.
Stack-based buffer overflow in Tenda W20E router firmware version 15.11.0.6 allows authenticated remote attackers to corrupt memory via the portMirrorMirroredPorts parameter in the /goform/setPortMirror endpoint handled by formSetPortMirror. Publicly available exploit code exists per VulDB submission, raising the practical risk of exploitation against exposed management interfaces, though no public exploit identified in CISA KEV. The CVSS 8.8 rating reflects high impact across confidentiality, integrity, and availability with low attack complexity.
RemediationAI
No vendor-released patch identified at time of analysis - Tenda has not published a fixed firmware version in the available references. As compensating controls, restrict administrative access to /goform/setPortMirror by binding the web management interface to trusted internal VLANs only and blocking it from WAN-side reachability (this disables remote management but is the strongest mitigation); enforce strong, unique administrator credentials since exploitation requires PR:L authentication, raising the bar against credential-stuffing chains; place the device behind a reverse proxy or WAF that filters oversized portMirrorMirroredPorts values (will not protect against authenticated insiders); and monitor the vendor site https://www.tenda.com.cn/ and the VulDB entry https://vuldb.com/vuln/369142 for an upcoming firmware release. Consider replacing the device with a supported model if Tenda does not issue a fix within an acceptable timeframe.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is the embedded web management application of the Tenda W20E enterprise router (CPE cpe:2.3:a:tenda:w20e:*), which exposes configuration endpoints under /goform/. The formSetPortMirror handler processes the portMirrorMirroredPorts argument and writes it into a fixed-size stack buffer without adequate length validation, matching CWE-121 (Stack-based Buffer Overflow). On typical MIPS/ARM SOHO router firmware, overflowing a stack buffer can overwrite the saved return address and, absent stack canaries or ASLR (commonly missing on this class of device), pivot execution to attacker-controlled data, frequently yielding code execution as the httpd process which runs with root privileges.
Know when W20E gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
Lifecycle Timeline
1DescriptionCVE.org
A vulnerability was detected in Tenda W20E 15.11.0.6. This vulnerability affects the function formSetPortMirror of the file /goform/setPortMirror. Performing a manipulation of the argument portMirrorMirroredPorts results in stack-based buffer overflow. The attack can be initiated remotely. The exploit is now public and may be used.
Executive ViewAI
The Tenda W20E router contains a stack-based buffer overflow vulnerability (CVE-2026-11522) in its port mirroring function allowing authenticated remote attackers to corrupt memory and potentially compromise network infrastructure. Organizations deploying this router model face immediate risk of network disruption, data interception, or unauthorized administrative access, with publicly available exploit code now available and no vendor patch currently released.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict management interface access via firewall rules limiting to trusted administrative networks; disable port mirroring feature if not operationally required; implement network segmentation isolating router management plane from production traffic; establish enhanced logging and real-time monitoring of management interface access attempts; consider temporary network isolation of affected devices until vendor patch release.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than it was allocated to hold.
Stack-based buffer overflow in Tenda W20E firmware 15.11.0.6(1068_1546_841)_CN_TDC enables remote low-privileged attacke
Stack-based buffer overflow in the Tenda W20E router (firmware 15.11.0.6) allows remote authenticated attackers to corru
Stack-based buffer overflow in Tenda W20E firmware 15.11.0.6 allows authenticated remote attackers to corrupt memory via
Stack-based buffer overflow in Tenda W20E firmware 15.11.0.6(1068_1546_841)_CN_TDC allows remote low-privileged attacker
Stack-based buffer overflow in Tenda W20E firmware 15.11.0.6(1068_1546_841)_CN_TDC allows authenticated remote attackers
Stack-based buffer overflow in Tenda W20E firmware 15.11.0.61068_1546_841_CN_TDC allows authenticated remote attackers t
Stack-based buffer overflow in the Tenda W20E router firmware (version 15.11.0.61068_1546_841_CN_TDC) allows a low-privi
Exploit-DB