Which versions of Tenda W20E are affected by EUVD-2026-35084?

Tenda W20E routers running firmware 15.11.0.6 contain a stack-based buffer overflow in the web management interface that allows authenticated attackers to corrupt router memory and compromise…

Is there a public PoC exploit available for EUVD-2026-35084?

Yes, a public proof-of-concept exploit is available for EUVD-2026-35084. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate EUVD-2026-35084?

Within 24 hours: Identify all Tenda W20E devices in your environment; confirm firmware version 15.11.0.6; restrict access to the web management interface (/goform/modifyWifiFilterRules endpoint) via IP whitelisting to authorized administrative networks only. Within 7 days: Disable WAN-accessible management features and require local network or VPN access for any remote administration; audit and strengthen administrator credentials; enable management interface logging. Within 30 days: Monitor Tenda security advisories for firmware updates; if no patch is released, develop a procurement and migration plan to replace affected routers with alternative platforms.

Tenda W20E EUVD-2026-35084

Q: What is the CVSS score of EUVD-2026-35084?

EUVD-2026-35084 has a CVSS 4.0 base score of 7.4 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

| CVE-2026-11524 HIGH

Stack-based Buffer Overflow (CWE-121)

2026-06-08 VulDB

GHSA-hmh7-xjhg-5rc9

Tenda Stack Overflow Buffer Overflow W20E

7.4

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

7.4 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Jun 08, 2026 - 16:29 vuln.today

v3 (cvss_changed)

Analysis Updated

Jun 08, 2026 - 16:29 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jun 08, 2026 - 16:22 vuln.today

cvss_changed

CVSS changed

Jun 08, 2026 - 16:22 NVD

8.8 (HIGH) 7.4 (HIGH)

Analysis Generated

Jun 08, 2026 - 16:17 vuln.today

DescriptionCVE.org

A vulnerability has been found in Tenda W20E 15.11.0.6. Impacted is the function modifyWifiFilterRules of the file /goform/modifyWifiFilterRules of the component Web Management Interface. The manipulation of the argument wifiFilterListRemark leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.

AnalysisAI

Stack-based buffer overflow in the Tenda W20E router (firmware 15.11.0.6) allows remote authenticated attackers to corrupt memory via the wifiFilterListRemark parameter of the /goform/modifyWifiFilterRules endpoint in the Web Management Interface. Publicly available exploit code exists per VulDB disclosure, raising the practical risk for exposed management interfaces, though no public exploit identified at time of analysis confirms active in-the-wild exploitation. CVSS 4.0 score of 7.4 reflects high confidentiality, integrity, and availability impact with low privileges required.

Technical ContextAI

The Tenda W20E is an enterprise-grade wireless router whose firmware exposes a web-based management interface implemented through /goform/ CGI-style handlers. The vulnerable function modifyWifiFilterRules processes WiFi MAC filter rule modifications, and the wifiFilterListRemark argument (a user-supplied remark/description field) is copied into a fixed-size stack buffer without proper bounds checking. This is a textbook CWE-121 (Stack-based Buffer Overflow), a memory safety flaw common in embedded MIPS/ARM router firmware where developers use unsafe C string functions like strcpy or sprintf. On such embedded Linux devices, stack overflows frequently lead to control of saved return addresses and ultimately arbitrary code execution as root, since router firmware rarely deploys modern mitigations like stack canaries, ASLR, or NX consistently. CPE data confirms cpe:2.3:a:tenda:w20e (all versions of the W20E line per the wildcard, with 15.11.0.6 explicitly named).

RemediationAI

No vendor-released patch identified at time of analysis - check https://www.tenda.com.cn/ for an updated W20E firmware release superseding 15.11.0.6 and apply it as soon as available. In the meantime, restrict access to the Web Management Interface by disabling remote/WAN-side administration entirely (the most effective compensating control, with the trade-off that administrators must be on the LAN or VPN to manage the device), enforce strong unique administrator credentials to raise the bar for the PR:L precondition, and place the management interface behind a firewall ACL that only permits trusted management subnets to reach /goform/modifyWifiFilterRules. Monitor the VulDB tracking pages (https://vuldb.com/vuln/369144 and https://vuldb.com/vuln/369144/cti) for vendor response updates, and consider replacing end-of-support W20E units if no firmware fix materializes.