Tenda W20E CVE-2026-11524

Exploitation requires network reachability to the Tenda W20E Web Management Interface (typically TCP/80 or TCP/443 on the LAN, or the WAN interface if remote management is enabled) and valid low-privileged authenticated credentials to the device (CVSS PR:L), allowing the attacker to invoke the /goform/modifyWifiFilterRules handler with an oversized wifiFilterListRemark parameter. Exploitation is limited to W20E devices running firmware 15.11.0.6 (and likely adjacent versions per the CPE wildcard); user interaction is not required (UI:N), but exposure is bounded by whether the management interface is reachable from the attacker's network position and whether default or guessable admin credentials are in use.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H) indicates network-reachable exploitation at low attack complexity with low privileges and no user interaction, yielding high impact across the CIA triad - a credible profile for full device compromise. Exploit maturity is rated 'P' (Proof of Concept), aligning with the VulDB-confirmed public POC on GitHub (Robots10/IoT_vlu). However, real-world risk is moderated by the PR:L requirement (the attacker must already hold valid management credentials) and by the fact that router admin interfaces should not be Internet-exposed in well-managed deployments - though Tenda SOHO/SMB devices are notoriously left with default or weak credentials and remote management enabled. There is no KEV listing and no EPSS score provided, so widespread mass exploitation cannot be confirmed; this is consistent with the typical pattern of VulDB-disclosed Tenda bugs, which often see opportunistic IoT-botnet adoption rather than targeted campaigns. Notable data gap: EPSS and KEV signals are absent from the input, so prioritization should lean on the public POC plus exposure assessment rather than statistical exploitation probability.

An attacker who has obtained low-privileged management credentials (via default passwords, credential stuffing, or a separate authentication weakness) authenticates to the Tenda W20E web interface and sends a crafted POST request to /goform/modifyWifiFilterRules with an overlong wifiFilterListRemark value. The oversized string overflows the stack buffer, overwriting the saved return address and pivoting execution to attacker-controlled shellcode, granting root-level command execution on the router. Public proof-of-concept code published on GitHub (Robots10/IoT_vlu) demonstrates the exact request needed, lowering the skill barrier substantially.