EUVD-2026-58622
GHSA-xrpr-8h65-75q6
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privilege credentials via default or weak password
-
DeliverySend crafted HTTP POST to /goform/delQos with oversized qosIndex
-
ExploitTrigger stack-based buffer overflow in formQOSRuleDel
-
ExecutionOverwrite saved return address on stack
-
ImpactExecute arbitrary code at firmware privilege level
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Stack buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Low-privilege authentication to the Tenda W20E web management interface is required, as indicated by PR:L in the CVSS 4.0 vector - unauthenticated exploitation is not supported by the available data. The attack targets the /goform/delQos endpoint, meaning the HTTP management interface must be network-reachable from the attacker's position. The specific firmware version 15.11.0.6(1068_1546_841)_CN_TDC is the confirmed affected build; other firmware versions may or may not be affected. Exploitation is limited by the need for valid (even low-privilege) credentials and by whether the management interface is exposed beyond a trusted LAN. Devices with management interfaces isolated behind a trusted VLAN or with non-default credentials present a materially reduced risk posture. |
| Impact | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H) scores 7.4 and indicates full confidentiality, integrity, and availability impact on the vulnerable system, requiring only low-privilege credentials and no user interaction. The PR:L metric is the primary limiting factor - unauthenticated exploitation is not indicated. A public POC is confirmed on GitHub, which materially raises exploitability beyond the raw CVSS score would suggest for a patched target. KEV listing is not confirmed, so mass exploitation in the wild has not been formally verified by CISA. EPSS data was not provided in the source intelligence. Real-world risk is elevated for deployments where the management interface is internet-facing or accessible from untrusted segments; it is lower where management is strictly isolated to a trusted LAN VLAN. The absence of a vendor-released patch is a compounding factor. No conflict between CVSS vector and description is detected - the description explicitly states remote exploitation. |
| Exploit ScenarioDerived | An attacker with low-level credentials to the Tenda W20E management interface - obtained via default credentials, credential stuffing, or prior compromise - sends a crafted HTTP POST request to /goform/delQos with an oversized qosIndex value. The formQOSRuleDel function copies the value into a stack buffer without bounds checking, overwriting the return address and enabling arbitrary code execution at router firmware privilege level. A public POC on GitHub (https://github.com/paueger/mycve/blob/main/Tenda_W20E/4.md) lowers the technical bar for exploitation significantly. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Aug 14, 2026
Stack-based buffer overflow in Tenda W20E firmware 15.11.0.6(1068_1546_841)_CN_TDC enables remote low-privileged attackers to execute arbitrary code by submitting a malformed qosIndex parameter to the /goform/delQos endpoint. The vulnerable formQOSRuleDel function fails to validate input length before writing to a fixed-size stack buffer in the QoS Rule Deletion component. A public proof-of-concept exploit is confirmed available on GitHub, significantly elevating real-world risk for any deployment with the management interface reachable by untrusted parties.
Earlier versions of this analysis (1)
Stack-based buffer overflow in the Tenda W20E router firmware version 15.11.0.6(1068_1546_841)_CN_TDC allows authenticated remote attackers to potentially execute arbitrary code or crash the device by sending a crafted qosIndex argument to the /goform/delQos web interface endpoint. The flaw resides in the formQOSRuleDel function handling QoS rule deletion, where unsanitized user input overflows a fixed-size stack buffer. A public proof-of-concept exploit has been released on GitHub, elevating near-term exploitation risk despite the absence of CISA KEV confirmation.
RemediationAI
No vendor-released patch has been identified at time of analysis. The primary recommended compensating control is to immediately restrict access to the router's web management interface so that /goform/delQos is not reachable from untrusted networks - concretely, apply firewall or ACL rules to block inbound HTTP/HTTPS to the management port from the WAN and any untrusted LAN segments; this eliminates the network attack vector without functional trade-off for most deployments. If the device supports disabling QoS rule management through an alternative interface or CLI, that feature should be disabled to reduce the attack surface. Changing default credentials to strong, unique values limits the PR:L exploitation prerequisite. Operators should monitor https://vuldb.com/vuln/389956 and https://www.tenda.com.cn/ for a firmware update and apply it immediately when released. Replacing the device with a supported model should be considered if no patch is forthcoming.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Tenda W20E is a Chinese-market SMB wireless router/AP. The device exposes a web-based management interface through CGI-style endpoints under /goform/. The formQOSRuleDel function handles HTTP requests to /goform/delQos and is responsible for processing QoS rule deletion by index. CWE-121 (Stack-Based Buffer Overflow) is the root cause: the qosIndex argument received from user-supplied HTTP input is copied into a fixed-size stack buffer without adequate bounds checking, allowing an attacker to overwrite adjacent stack memory including the saved return address. CPE cpe:2.3:a:tenda:w20e:*:*:*:*:*:*:*:* covers the affected product family. Stack overflows of this class in embedded router firmware are routinely leveraged for remote code execution, as stack canaries and ASLR are frequently absent or weak on such MIPS/ARM-based devices.
Know when W20E gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Network-accessible management endpoint with confirmed public POC; PR:L reflects low-privilege authentication requirement per CVSS 4.0 source vector; full CIA impact on the device.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
2DescriptionCVE.org
A security flaw has been discovered in Tenda W20E 15.11.0.6(1068_1546_841)_CN_TDC. Impacted is the function formQOSRuleDel of the file /goform/delQos of the component QoS Rule Deletion. Performing a manipulation of the argument qosIndex results in stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks.
Latest POC
1 public PoC link from github
Sign in to open the public PoC links collected for this CVE.
Executive ViewAI
Tenda W20E firmware version 15.11.0.6 and earlier contains a remote code execution vulnerability in the QoS management interface that is exploitable by low-privileged network users, with public proof-of-concept code available and no vendor patch identified. Organizations deploying these devices face potential unauthorized control of network management functions and downstream network infrastructure compromise if the management interface is reachable from untrusted network segments. Immediate containment of management interface access is required given active exploit availability.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict management interface network access to authorized administrative subnets only via firewall enforcement; disable QoS rule management functionality if operationally acceptable; implement network intrusion detection signatures for malformed qosIndex parameter requests to /goform/delQos; segment management interface from general network traffic; maintain detailed inventory of affected device locations; consider temporary replacement with patched alternative equipment; conduct daily security monitoring for anomalous management interface activity.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than it was allocated to hold.
Stack-based buffer overflow in the Tenda W20E router (firmware 15.11.0.6) allows remote authenticated attackers to corru
Stack-based buffer overflow in Tenda W20E firmware 15.11.0.6 allows authenticated remote attackers to corrupt memory via
Stack-based buffer overflow in the Tenda W20E router (firmware 15.11.0.6) allows remote authenticated attackers to corru
Stack-based buffer overflow in Tenda W20E firmware 15.11.0.6(1068_1546_841)_CN_TDC allows remote low-privileged attacker
Stack-based buffer overflow in Tenda W20E firmware 15.11.0.6(1068_1546_841)_CN_TDC allows authenticated remote attackers
Stack-based buffer overflow in Tenda W20E firmware 15.11.0.61068_1546_841_CN_TDC allows authenticated remote attackers t
Stack-based buffer overflow in the Tenda W20E router firmware (version 15.11.0.61068_1546_841_CN_TDC) allows a low-privi
Exploit-DB