Skip to main content

Tenda W20E EUVD-2026-35080

| CVE-2026-11523 HIGH
Stack-based Buffer Overflow (CWE-121)
2026-06-08 VulDB GHSA-pj5q-9vg7-6xmx
Tenda Stack Overflow Buffer Overflow
7.4
CVSS 4.0
Share

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
X

Lifecycle Timeline

5
Analysis Updated
Jun 08, 2026 - 16:30 vuln.today
v3 (cvss_changed)
Analysis Updated
Jun 08, 2026 - 16:30 vuln.today
v2 (cvss_changed)
Re-analysis Queued
Jun 08, 2026 - 16:22 vuln.today
cvss_changed
CVSS changed
Jun 08, 2026 - 16:22 NVD
8.8 (HIGH) 7.4 (HIGH)
Analysis Generated
Jun 08, 2026 - 16:15 vuln.today

DescriptionNVD

A flaw has been found in Tenda W20E 15.11.0.6. This issue affects the function formPortalAuth of the file /goform/PortalAuth of the component Web Management Interface. Executing a manipulation of the argument gotoUrl can lead to stack-based buffer overflow. The attack can be launched remotely. The exploit has been published and may be used.

AnalysisAI

Stack-based buffer overflow in Tenda W20E firmware 15.11.0.6 allows authenticated remote attackers to corrupt memory via the gotoUrl parameter handled by the formPortalAuth function in /goform/PortalAuth of the Web Management Interface. Publicly available exploit code exists, raising the likelihood of opportunistic targeting of internet-exposed router management interfaces, though no public exploit identified as actively exploited per CISA KEV at time of analysis.

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Recon
Identify exposed W20E management interface
Delivery
Obtain low-privileged credentials
Exploit
Send crafted POST to /goform/PortalAuth with oversized gotoUrl
Install
Overflow stack buffer in formPortalAuth
C2
Overwrite return address with shellcode pointer
Execute
Execute arbitrary code as root
Impact
Install persistent backdoor or join botnet
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Attacker requires network reachability to the W20E Web Management Interface (TCP HTTP/HTTPS) and valid low-privileged credentials per CVSS PR:L - exploitation is not unauthenticated. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 score of 7.4 (High) reflects network attack vector (AV:N), low attack complexity (AC:L), and high confidentiality/integrity/availability impact (VC:H/VI:H/VA:H), but is moderated by the requirement for low-level privileges (PR:L) - meaning some form of authentication or low-privileged session is required. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker who has obtained low-privileged credentials (e.g., a guest or read-only admin account, or default/weak credentials common on SOHO routers) reaches the device's web management interface over the network and submits a crafted POST request to /goform/PortalAuth with an oversized gotoUrl parameter, overflowing the stack buffer in formPortalAuth and overwriting the saved return address to redirect execution to attacker-supplied shellcode. Successful exploitation grants code execution as the web server process - typically root on embedded firmware - enabling persistent backdoor installation, DNS hijacking, or recruitment into IoT botnets. …
Remediation No vendor-released patch identified at time of analysis - the Tenda reference points only to the vendor homepage rather than a security advisory or firmware update. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

24 hours: Inventory all Tenda W20E routers and identify those with public internet access to the web management interface; disable remote management on all devices where it is not required. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More from same product – last 7 days

CVE-2026-11503 HIGH POC
7.4 Jun 08

Stack-based buffer overflow in the Tenda CX12L router (firmware 16.03.53.12) allows authenticated remote attackers to co
CVE-2026-11504 HIGH POC
7.4 Jun 08

Stack-based buffer overflow in Tenda CX12L 16.03.53.12 routers allows remote attackers with low privileges to corrupt me
CVE-2026-11522 HIGH POC
7.4 Jun 08

Stack-based buffer overflow in the Tenda W20E router (firmware 15.11.0.6) allows remote authenticated attackers to corru
CVE-2026-11524 HIGH POC
7.4 Jun 08

Stack-based buffer overflow in the Tenda W20E router (firmware 15.11.0.6) allows remote authenticated attackers to corru
CVE-2026-11528 HIGH POC
7.4 Jun 08

Stack-based buffer overflow in the Tenda AC18 router (firmware 15.03.05.05) Web Management Interface allows remote attac

Share

EUVD-2026-35080 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy