Tenda W20E CVE-2026-19822

Exploitation requires network-level access to the Tenda W20E web administration interface (typically HTTP on port 80 or HTTPS on port 443) and a valid set of low-privilege credentials (PR:L per CVSS 4.0). The /goform/editQos endpoint and the QoS feature must be reachable - this is default behavior in the CN_TDC firmware variant. No additional non-default configuration is required beyond the device being powered on and network-accessible. Exploitation is constrained by the authentication requirement: unauthenticated remote attackers cannot directly trigger the overflow without first obtaining credentials. The CN_TDC firmware designation is explicit; other regional or OEM firmware variants are not confirmed vulnerable without independent analysis. No user interaction on the victim side is required once the attacker is authenticated.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H) establishes a network-reachable, low-complexity attack requiring only low-privilege credentials, yielding a 7.4 base score. The E:P supplemental modifier confirms publicly available exploit code, which compresses the theoretical-to-practical gap significantly. CISA KEV status is not confirmed and EPSS data was not provided, leaving active exploitation unverified. The combination of PR:L authentication gate and a working public PoC means the barrier to exploitation is low for any attacker who can obtain even basic credentials - even a mid-sized municipal IT team in ustka should treat this as urgent if Tenda W20E devices are deployed on their network. The high VC/VI/VA triad suggests complete device compromise is the expected outcome, including exposure of any credentials or tunneled traffic processed by the router. There is no conflict between CVSS signals and the description; the local-network-administration-to-remote framing is consistent.

An attacker with low-privilege credentials to the Tenda W20E web admin interface crafts an HTTP POST request to /goform/editQos with a qosListConnecttedNum parameter value exceeding the fixed stack buffer allocated in lstAdd. The overflow corrupts the return address on the stack, redirecting execution to attacker-controlled shellcode or a ROP chain. A public proof-of-concept on GitHub (https://github.com/paueger/mycve/blob/main/Tenda_W20E/3.md) demonstrates the technique, making this straightforward for a moderately skilled attacker to reproduce against any reachable instance of the vulnerable firmware.