Tenda W20E CVE-2026-11523

Attacker requires network reachability to the W20E Web Management Interface (TCP HTTP/HTTPS) and valid low-privileged credentials per CVSS PR:L - exploitation is not unauthenticated. The exact vulnerable endpoint is /goform/PortalAuth and the trigger is supplying an overlong value to the gotoUrl parameter handled by formPortalAuth. Limiting factors: the management interface must be reachable from the attacker (often LAN-only in default deployments, but commonly exposed to WAN on misconfigured devices); authentication is required, though weak/default credentials on consumer routers frequently render this trivial; only firmware 15.11.0.6 of the W20E model is confirmed affected, though CPE wildcards suggest other versions may also be vulnerable.

The CVSS 4.0 score of 7.4 (High) reflects network attack vector (AV:N), low attack complexity (AC:L), and high confidentiality/integrity/availability impact (VC:H/VI:H/VA:H), but is moderated by the requirement for low-level privileges (PR:L) - meaning some form of authentication or low-privileged session is required. The E:P metric confirms a proof-of-concept exists, aligning with the published exploit on GitHub. No EPSS score, KEV listing, or SSVC decision data was provided, so widespread automated exploitation cannot be confirmed; however, given that PoC code is publicly hosted and Tenda routers are frequent botnet recruitment targets (Mirai-family malware), real-world risk should be treated as elevated for any device with an internet-exposed management UI. The PR:L requirement is a meaningful limiting factor - defenders should not equate this with an unauthenticated RCE, though weak default credentials on consumer routers often render this barrier trivial in practice.

An attacker who has obtained low-privileged credentials (e.g., a guest or read-only admin account, or default/weak credentials common on SOHO routers) reaches the device's web management interface over the network and submits a crafted POST request to /goform/PortalAuth with an oversized gotoUrl parameter, overflowing the stack buffer in formPortalAuth and overwriting the saved return address to redirect execution to attacker-supplied shellcode. Successful exploitation grants code execution as the web server process - typically root on embedded firmware - enabling persistent backdoor installation, DNS hijacking, or recruitment into IoT botnets. A public PoC is available on GitHub, lowering the skill barrier for adoption.