EUVD-2026-60537
GHSA-jc23-xx5m-j5wr
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach router management interface
-
DeliverySend crafted over-long parameter
-
ExploitOverflow stack buffer (CWE-121)
-
ExecutionOverwrite saved return address
-
PersistExecute arbitrary code on device
-
ImpactIntercept or pivot network traffic
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Stack buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network reachability to the vulnerable service on a Tenda W20E running firmware V16.01.0.6(2782); no authentication and no user interaction are needed per the CVSS vector (AV:N/AC:L/PR:N/UI:N). The primary limiting factor is exposure of the vulnerable interface: on most Tenda SOHO routers the affected web/GoForm handler is LAN-facing by default, so practical remote attack requires WAN-side/remote management to be enabled or the attacker to already be on the local network. Exploitation is also constrained to the exact vulnerable firmware build, and because this is an incomplete fix, devices patched only against CVE-2025-44867/CVE-2026-36819 remain exploitable via the residual code path. |
| Impact | The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8) describes a trivially reachable, unauthenticated, network-exploitable RCE, which normally warrants top priority. The exploitation signals conflict, however: EPSS is very low (0.17%, 7th percentile) and the CVE is NOT in CISA KEV, suggesting no automated mass exploitation is currently observed - typical for niche SOHO router CVEs that are technically severe but see targeted rather than widespread abuse. A key caveat: CVSS AV:N assumes the vulnerable service is network-reachable, yet many such Tenda overflows sit in the LAN-facing web/GoForm interface, so real-world exposure depends heavily on whether WAN-side management is enabled - not confirmed in the input. The 'incomplete fix' status raises risk because prior CVE publicity gives attackers a head start on the code path. Overall: genuinely high technical severity but currently modest observed-exploitation risk; prioritize for internet-exposed or WAN-management-enabled devices. |
| Exploit ScenarioDerived | An attacker who can reach the router's management/service interface sends a crafted request with an over-long parameter that overflows a fixed-size stack buffer, overwriting the saved return address and redirecting execution to attacker-supplied code, yielding full code execution on the router. Because a public disclosure repository exists, working proof-of-concept details are likely available, and the low complexity (AC:L) with no authentication (PR:N) makes the attack straightforward once the service is reachable. A compromised router can then intercept, redirect, or man-in-the-middle all traffic on the network. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 18, 2026
Remote code execution in the Tenda W20E router firmware V16.01.0.6(2782) lets unauthenticated network attackers overflow a stack buffer and run arbitrary code on the device. The flaw is explicitly an incomplete fix for the earlier CVE-2025-44867 and CVE-2026-36819, meaning the same code path remains exploitable despite prior patch attempts. A public vulnerability-disclosure repository exists, but the issue is not in CISA KEV and carries a low EPSS score (0.17%, 7th percentile), indicating no confirmed widespread exploitation yet.
RemediationAI
No vendor-released patched firmware version is identified in the available data, and because this is an incomplete fix for CVE-2025-44867 and CVE-2026-36819, applying only those prior updates is insufficient - treat the device as unpatched until Tenda publishes a build later than V16.01.0.6(2782), and monitor the disclosure repo at https://github.com/H0111mes/Tenda-W20E-Vulnerability-Disclosure and the NVD record at https://nvd.nist.gov/vuln/detail/CVE-2026-67967 for a fixed release. For compensating controls, disable remote/WAN-side web management so the vulnerable interface is not reachable from the internet (side effect: administration must be done from the LAN); restrict access to the router's HTTP management interface to a trusted management VLAN or specific admin hosts via ACL (side effect: breaks casual admin access from arbitrary clients); place the device behind an upstream firewall blocking inbound access to its management port; and for high-value networks consider replacing the device with a supported model if no timely firmware fix appears.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The Tenda W20E is a small-office/home-office wireless router whose web management and service daemons run on an embedded Linux platform. The root cause is CWE-121 (stack-based buffer overflow): attacker-controlled input is copied into a fixed-size stack buffer without adequate bounds checking, allowing return-address or saved-register corruption and control-flow hijack. Because this is documented as an incomplete fix for CVE-2025-44867 and CVE-2026-36819, the prior remediation likely tightened one input path or length check while leaving a related sink or alternate parameter still vulnerable - a common pattern in embedded router firmware where multiple handlers share unsafe string-copy routines. CPE data is not usable here (the record contains the placeholder cpe:2.3:a:n/a:n/a), so the exact affected component must be inferred from the vendor firmware string V16.01.0.6(2782).
Know when N A gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated stack overflow reachable over the network with low complexity yields full code execution, so AV:N/AC:L/PR:N/UI:N and C:H/I:H/A:H; service reachability is a practical caveat, not a base-metric change.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
Buffer Overflow vulnerability in Tenda W20E V16.01.0.6(2782) allows an attacker to execute arbitrary code. This is an incomplete fix for CVE-2025-44867 and CVE-2026-36819
Executive ViewAI
The Tenda W20E router (firmware V16.01.0.6(2782)) contains an unauthenticated remote code execution vulnerability (CVSS 9.8) that could allow attackers to gain complete device control without credentials. Organizations using this router model risk full compromise of network traffic, content injection attacks, and lateral network access for further attacks. With no vendor patch available, affected hardware must be replaced to eliminate this uncontrollable risk.
No vendor-released patch identified at time of analysis. Implement network isolation via firewall rules restricting inbound access to affected Tenda W20E devices, segment these routers from critical systems and sensitive data, enable monitoring for exploitation indicators, and execute immediate hardware replacement with patched alternate vendor solutions.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than it was allocated to hold.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Exploit-DB