EUVD-2026-77311
GHSA-crxm-72cq-869m
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain valid router web UI credentials
-
DeliveryConnect to W20E management interface over network
-
ExploitSubmit crafted webAuthWhiteUserIndex to formDelWebAuthWhiteUser
-
ExecutionOverflow fixed-size stack buffer
-
PersistOverwrite return address
-
ImpactExecute arbitrary code as root
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Stack buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network reachability to the Tenda W20E HTTP web management interface and valid credentials at low privilege (per CVSS 4.0 PR:L - at minimum a logged-in web UI session). The specific trigger is a crafted value for the webAuthWhiteUserIndex argument submitted to the formDelWebAuthWhiteUser handler. Exploitation is limited when the management interface is restricted to LAN-only or trusted-host access, and when strong non-default credentials are in use. The confirmed affected firmware is 15.11.0.61068_1546_841_CN_TDC; other W20E firmware versions are not explicitly confirmed but may share the same code path given the wildcard CPE. No special hardware configuration or enabled feature beyond the web management interface itself is required. |
| Impact | The CVSS 4.0 vector (8.7) indicates low-complexity, low-privilege, network-exploitable exploitation with high impact across all three dimensions - a credible high-severity finding for an internet-exposed management interface. The critical mitigating factor is PR:L: the attacker must already possess valid credentials to the router web UI, substantially reducing opportunistic mass-exploitation risk compared to a PR:N flaw. No EPSS score is provided in the intelligence, and the vulnerability is not in CISA KEV, confirming no confirmed active exploitation at time of analysis. However, a researcher-published GitHub advisory at https://github.com/Amalll-Sec/router-vulnerability-research/blob/main/advisories/Tenda/W20E/formDelWebAuthWhiteUser/README.md suggests technical details are public, which may accelerate weaponization. Tenda devices are frequently shipped with weak or default credentials and management interfaces exposed to WAN, meaning the PR:L barrier may be practically low in many deployments. Real-world priority is moderate-to-high for organizations with exposed Tenda W20E devices, but low for environments with properly hardened management access. |
| Exploit ScenarioDerived | An attacker who has obtained valid Tenda W20E web UI credentials - through credential stuffing against default admin passwords common on Tenda devices, or via network sniffing on an unencrypted management session - sends a crafted HTTP request to the formDelWebAuthWhiteUser endpoint with an oversized webAuthWhiteUserIndex value. The stack buffer overflow overwrites the saved return address, redirecting execution to attacker-controlled shellcode or a ROP chain, achieving root-level code execution on the router. A researcher-published advisory on GitHub documents the vulnerable function and parameter, providing a roadmap for exploit development. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 14, 2026
Stack-based buffer overflow in Tenda W20E firmware 15.11.0.61068_1546_841_CN_TDC allows authenticated remote attackers to corrupt stack memory by supplying an oversized value to the webAuthWhiteUserIndex argument in the formDelWebAuthWhiteUser function, potentially enabling arbitrary code execution in the web server process. The vulnerability is network-exploitable with low-privilege credentials (PR:L per CVSS 4.0), and the CVSS 4.0 score of 8.7 reflects high impact across confidentiality, integrity, and availability. No public exploit has been confirmed and the vulnerability is not in CISA KEV, but a researcher-published GitHub advisory documents the attack surface.
RemediationAI
No vendor-released patch has been identified at time of analysis. Administrators should immediately restrict the Tenda W20E web management interface to trusted internal subnets only, disabling any WAN-side remote management access - this eliminates the network vector for unauthenticated or low-credential attackers. Replacing weak or default router credentials with strong, unique passwords directly addresses the PR:L precondition and significantly raises the exploitation bar. Where feasible, consider placing the management interface behind an out-of-band management VLAN with additional access controls. Monitor https://www.tenda.com.cn/ and the VulDB tracking entry at https://vuldb.com/vuln/403222 for firmware updates; if none are forthcoming and the device handles sensitive traffic, evaluate replacement with a supported platform. Note that restricting management access does not remediate the underlying buffer overflow but eliminates remote reachability.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The Tenda W20E is a small-business/enterprise wireless router running embedded Linux firmware. The vulnerable function formDelWebAuthWhiteUser handles deletion of entries from the Web Authentication user whitelist via the router's HTTP-based management interface. The function accepts the webAuthWhiteUserIndex parameter without validating its length before copying it into a fixed-size stack-allocated buffer, resulting in a classic CWE-121 (Stack-based Buffer Overflow). On embedded router platforms, the web server process frequently runs as root, meaning a successfully exploited stack return-address overwrite achieves full device compromise. The affected CPE is cpe:2.3:a:tenda:w20e:*:*:*:*:*:*:*:*, with the specific confirmed firmware version being 15.11.0.61068_1546_841_CN_TDC (a Chinese market build, indicated by the CN_TDC suffix). The CVSS 4.0 vector AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N is consistent with a network-reachable web management endpoint requiring only valid credentials and no special environmental conditions.
Know when W20E gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Network-accessible web interface requires low-privilege credentials; stack overflow yields full device compromise but scope remains unchanged within the router.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
DescriptionCVE.org
A security flaw has been discovered in Tenda W20E 15.11.0.61068_1546_841_CN_TDC. Impacted is the function formDelWebAuthWhiteUser. Performing a manipulation of the argument webAuthWhiteUserIndex results in stack-based buffer overflow. The attack can be initiated remotely.
Executive ViewAI
Tenda W20E wireless routers running firmware version 15.11.0.61068_1546_841_CN_TDC are vulnerable to a stack buffer overflow in the web administration interface that enables remote code execution with high impact across confidentiality, integrity, and availability. The vulnerability requires only low-privilege authenticated credentials to exploit, making it accessible to any user with valid web interface access and creating significant risk to network infrastructure and organizational assets.
No vendor-released patch identified at time of analysis. Interim mitigations include: restrict web administration interface access exclusively to trusted management networks via firewall access control lists; implement mandatory strong, unique credentials with periodic rotation for all privileged accounts; deploy Web Application Firewall (WAF) to detect and reject malformed webAuthWhiteUserIndex parameter submissions; establish comprehensive logging, monitoring, and alerting for authentication failures and anomalous web server behavior; identify and prepare network isolation or device replacement alternatives if vendor patch resolution extends beyond 60 days.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than it was allocated to hold.
Stack-based buffer overflow in Tenda W20E firmware 15.11.0.6(1068_1546_841)_CN_TDC enables remote low-privileged attacke
Stack-based buffer overflow in the Tenda W20E router (firmware 15.11.0.6) allows remote authenticated attackers to corru
Stack-based buffer overflow in Tenda W20E firmware 15.11.0.6 allows authenticated remote attackers to corrupt memory via
Stack-based buffer overflow in the Tenda W20E router (firmware 15.11.0.6) allows remote authenticated attackers to corru
Stack-based buffer overflow in Tenda W20E firmware 15.11.0.6(1068_1546_841)_CN_TDC allows remote low-privileged attacker
Stack-based buffer overflow in Tenda W20E firmware 15.11.0.6(1068_1546_841)_CN_TDC allows authenticated remote attackers
Stack-based buffer overflow in the Tenda W20E router firmware (version 15.11.0.61068_1546_841_CN_TDC) allows a low-privi
Exploit-DB