EUVD-2026-35077
GHSA-3fr6-p7vj-gvw2
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
5DescriptionCVE.org
A vulnerability was detected in Tenda W20E 15.11.0.6. This vulnerability affects the function formSetPortMirror of the file /goform/setPortMirror. Performing a manipulation of the argument portMirrorMirroredPorts results in stack-based buffer overflow. The attack can be initiated remotely. The exploit is now public and may be used.
AnalysisAI
Stack-based buffer overflow in the Tenda W20E router (firmware 15.11.0.6) allows remote authenticated attackers to corrupt memory via the portMirrorMirroredPorts parameter handled by formSetPortMirror in /goform/setPortMirror. Publicly available exploit code exists, raising the practical risk for exposed management interfaces, though no CISA KEV listing or EPSS data is provided to confirm widespread exploitation. The flaw enables high impact on confidentiality, integrity, and availability of the device per the CVSS 4.0 vector.
Technical ContextAI
The affected component is the embedded web management application of the Tenda W20E enterprise router (CPE cpe:2.3:a:tenda:w20e:*), which exposes configuration endpoints under /goform/. The formSetPortMirror handler processes the portMirrorMirroredPorts argument and writes it into a fixed-size stack buffer without adequate length validation, matching CWE-121 (Stack-based Buffer Overflow). On typical MIPS/ARM SOHO router firmware, overflowing a stack buffer can overwrite the saved return address and, absent stack canaries or ASLR (commonly missing on this class of device), pivot execution to attacker-controlled data, frequently yielding code execution as the httpd process which runs with root privileges.
RemediationAI
No vendor-released patch identified at time of analysis - Tenda has not published a fixed firmware version in the available references. As compensating controls, restrict administrative access to /goform/setPortMirror by binding the web management interface to trusted internal VLANs only and blocking it from WAN-side reachability (this disables remote management but is the strongest mitigation); enforce strong, unique administrator credentials since exploitation requires PR:L authentication, raising the bar against credential-stuffing chains; place the device behind a reverse proxy or WAF that filters oversized portMirrorMirroredPorts values (will not protect against authenticated insiders); and monitor the vendor site https://www.tenda.com.cn/ and the VulDB entry https://vuldb.com/vuln/369142 for an upcoming firmware release. Consider replacing the device with a supported model if Tenda does not issue a fix within an acceptable timeframe.
Stack-based buffer overflow in Tenda W20E firmware 15.11.0.6(1068_1546_841)_CN_TDC enables remote low-privileged attacke
Stack-based buffer overflow in the Tenda W20E router (firmware 15.11.0.6) allows remote authenticated attackers to corru
Stack-based buffer overflow in Tenda W20E firmware 15.11.0.6 allows authenticated remote attackers to corrupt memory via
Stack-based buffer overflow in Tenda W20E firmware 15.11.0.6(1068_1546_841)_CN_TDC allows remote low-privileged attacker
Stack-based buffer overflow in Tenda W20E firmware 15.11.0.6(1068_1546_841)_CN_TDC allows authenticated remote attackers
Same weakness CWE-121 – Stack-based Buffer Overflow
View allSame technique Stack Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today