EUVD-2026-58655
GHSA-9293-28jp-jjpj
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
PR:L reflects required web interface authentication; S:U because exploitation impacts only the router itself with no confirmed scope change to adjacent systems.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
5DescriptionCVE.org
A weakness has been identified in Tenda W20E 15.11.0.6(1068_1546_841)_CN_TDC. The affected element is the function ipMacBindListStore of the file /goform/addIpMacBind. Executing a manipulation of the argument IPMacBindRule can lead to stack-based buffer overflow. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks.
AnalysisAI
Stack-based buffer overflow in Tenda W20E firmware 15.11.0.6(1068_1546_841)_CN_TDC allows remote low-privileged attackers to corrupt stack memory and potentially execute arbitrary code by sending a crafted value in the IPMacBindRule argument to the /goform/addIpMacBind endpoint. The vulnerable function ipMacBindListStore fails to validate input length before writing to a fixed-size stack buffer (CWE-121). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires network-level access to the Tenda W20E's web management interface (HTTP/HTTPS) and a valid low-privilege account on the device (PR:L per CVSS 4.0 vector - unauthenticated exploitation is not confirmed). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 base score of 7.4 reflects network-reachable (AV:N), low-complexity (AC:L) exploitation requiring low privileges (PR:L) with high impact across confidentiality, integrity, and availability on the vulnerable system. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who has obtained low-privilege credentials to the Tenda W20E web interface - for example, through credential reuse, default password exploitation, or a phishing attack - sends a crafted HTTP POST request to /goform/addIpMacBind with an oversized IPMacBindRule parameter value. The ipMacBindListStore function copies this input onto the stack without bounds checking, overwriting the return address or stack canary and redirecting execution to attacker-controlled code. … |
| Remediation | No vendor-released patch has been identified at time of analysis - administrators should monitor https://www.tenda.com.cn/ for updated firmware and apply any release that addresses CVE-2026-19824 when available. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Inventory all Tenda W20E devices and confirm firmware version 15.11.0.6; immediately restrict web management interface access via firewall to trusted administrative IP addresses only and disable remote management if operationally feasible. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Stack-based buffer overflow in Tenda W20E firmware 15.11.0.6(1068_1546_841)_CN_TDC enables remote low-privileged attacke
Stack-based buffer overflow in the Tenda W20E router (firmware 15.11.0.6) allows remote authenticated attackers to corru
Stack-based buffer overflow in Tenda W20E firmware 15.11.0.6 allows authenticated remote attackers to corrupt memory via
Stack-based buffer overflow in the Tenda W20E router (firmware 15.11.0.6) allows remote authenticated attackers to corru
Stack-based buffer overflow in Tenda W20E firmware 15.11.0.6(1068_1546_841)_CN_TDC allows authenticated remote attackers
Same weakness CWE-121 – Stack-based Buffer Overflow
View allSame technique Stack Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today