Tenda W20E CVE-2026-19824

Exploitation requires network-level access to the Tenda W20E's web management interface (HTTP/HTTPS) and a valid low-privilege account on the device (PR:L per CVSS 4.0 vector - unauthenticated exploitation is not confirmed). The vulnerability is triggered by submitting a malformed IPMacBindRule argument via HTTP POST to the /goform/addIpMacBind endpoint, which invokes the ipMacBindListStore function. No additional non-default configuration appears required beyond the web server being reachable - the addIpMacBind handler is a standard feature of the firmware's IP-MAC binding functionality. Exploitation is limited by the authentication requirement; however, this bar is significantly lowered if the device retains default credentials. The firmware version is specifically 15.11.0.6(1068_1546_841)_CN_TDC; applicability to other versions or regional builds is not confirmed from available data.

The CVSS 4.0 base score of 7.4 reflects network-reachable (AV:N), low-complexity (AC:L) exploitation requiring low privileges (PR:L) with high impact across confidentiality, integrity, and availability on the vulnerable system. The E:P temporal modifier confirms publicly available exploit code, elevating the operational risk above the base score alone. No EPSS data was provided, and the CVE is not listed in the CISA KEV catalog, suggesting exploitation has not been confirmed as widespread at time of analysis - though the public PoC on GitHub materially lowers the bar for exploitation. Even a mid-sized municipal IT team in kalisz managing a campus network should treat this as urgent if Tenda W20E devices are deployed, given that low-privilege credentials are often shared or weakly protected in small-office environments. The primary limiting factor is the PR:L requirement - unauthenticated exploitation is not supported by the CVSS vector - but this is a modest barrier if default credentials are in use. CVSS scope is unchanged (SC:N/SI:N/SA:N), indicating impact is confined to the router itself unless lateral movement is chained post-exploitation.

An attacker who has obtained low-privilege credentials to the Tenda W20E web interface - for example, through credential reuse, default password exploitation, or a phishing attack - sends a crafted HTTP POST request to /goform/addIpMacBind with an oversized IPMacBindRule parameter value. The ipMacBindListStore function copies this input onto the stack without bounds checking, overwriting the return address or stack canary and redirecting execution to attacker-controlled code. A proof-of-concept demonstrating this technique is publicly available at the referenced GitHub repository, meaning the attack requires minimal development effort to operationalize.