Tenda W20E CVE-2026-67966

The concrete prerequisite is network reachability of the router's HTTP management interface so the /goform/telnet endpoint can be requested; no credentials, user interaction, or non-default settings are required (CVSS AV:N/AC:L/PR:N/UI:N), consistent with the CWE-306 missing-authentication root cause. Exploitation is limited primarily by exposure: if the management interface is confined to the LAN or a management VLAN, a remote Internet attacker cannot reach it and the attack requires local/adjacent network position. It is confirmed only against firmware V16.01.0.6(2782); other builds are unverified. A secondary condition is that Telnet (TCP/23) must then be reachable by the attacker to use the freshly enabled shell.

The signals conflict in a way worth calling out: the CVSS 3.1 base score is 9.8 (network, low complexity, no privileges, no user interaction, full C/I/A impact), which is maximal for a remote root vulnerability, yet the EPSS score is only 0.19% (9th percentile) and it is not in CISA KEV - indicating no evidence of widespread automated exploitation at this time. That gap is typical for newly disclosed embedded-device flaws: the technical severity is unquestionable, but real-world blast radius depends heavily on how many W20E units expose their management interface (or Telnet) to untrusted networks. Where the router's admin interface is reachable - especially any WAN-side or remotely-managed deployment - this is trivially exploitable and should be treated as urgent, since the outcome is unauthenticated root. Where the interface is LAN-only and segmented, the practical risk drops to insider or pivoted-attacker scenarios. The presence of a public disclosure repository raises the likelihood of opportunistic scanning increasing over time, so the low EPSS should be read as 'not yet widely weaponized' rather than 'low priority.'

An attacker who can reach the router's web management port sends a single crafted HTTP request to /goform/telnet, which starts the Telnet daemon without authentication. The attacker then connects over Telnet and obtains a root shell, gaining full control to intercept traffic, alter DNS/routing, or pivot into the internal network. A public disclosure repository documents the issue and reproduction steps, lowering the skill barrier for others.