The vulnerability of the gstruleQos function (goform/guestWifiRuleRefresh) in the Tenda W20E router software allows a intruder to execute arbitrary commands.

The vulnerability of the gstruleQos function goform/guestWifiRuleRefresh in the Tenda W20E router microprogramming software is related to the execution of operations outside the buffer in the gstup and gstdwn parameters’ memory. Exploiting this vulnerability allows a remote attacker to execute...

CVE-2026-24115

An issue was discovered in Tenda W20E V4.0brV15.11.0.6. Failure to validate the sizes of gstup and gstdwn before concatenating them into gstruleQos may lead to buffer overflow...

CVE-2026-24115

Summary (CVE-2026-24115) : Affects Tenda W20E router firmware version V4.0br_V15.11.0.6. The issue is a failure to validate the sizes of the buffers ‘gstup’ and ‘gstdwn’ before concatenating them into ‘gstruleQos’, which can cause a buffer overflow. CVSS v3.1 base score is 9.8 (CRITICAL) with net...

CVE-2026-24115

An issue was discovered in Tenda W20E V4.0brV15.11.0.6. Failure to validate the sizes of gstup and gstdwn before concatenating them into gstruleQos may lead to buffer overflow...

CVE-2026-24115

An issue was discovered in Tenda W20E V4.0brV15.11.0.6. Failure to validate the sizes of gstup and gstdwn before concatenating them into gstruleQos may lead to buffer overflow...

CVE-2026-24115: Buffer Copy without Checking Size of Input

An issue was discovered in Tenda W20E V4.0brV15.11.0.6. Failure to validate the sizes of gstup and gstdwn before concatenating them into gstruleQos may lead to buffer overflow...