311 matches found
The vulnerability of the gstruleQos function (goform/guestWifiRuleRefresh) in the Tenda W20E router software allows a intruder to execute arbitrary commands.
The vulnerability of the gstruleQos function goform/guestWifiRuleRefresh in the Tenda W20E router microprogramming software is related to the execution of operations outside the buffer in the gstup and gstdwn parameters’ memory. Exploiting this vulnerability allows a remote attacker to execute...
CVE-2026-90689
A security flaw has been discovered in Tenda W20E 15.11.0.610681546841CNTDC. Impacted is the function formDelWebAuthWhiteUser. Performing a manipulation of the argument webAuthWhiteUserIndex results in stack-based buffer overflow. The attack can be initiated remotely...
CVE-2026-90688
A vulnerability was identified in Tenda W20E 15.11.0.610681546841CNTDC. This issue affects the function formIPMacBindAdd of the component HTTP Handler. Such manipulation of the argument IPMacBindRule leads to stack-based buffer overflow. It is possible to launch the attack remotely...
CVE-2026-90689 Tenda W20E formDelWebAuthWhiteUser stack-based overflow
A security flaw has been discovered in Tenda W20E 15.11.0.610681546841CNTDC. Impacted is the function formDelWebAuthWhiteUser. Performing a manipulation of the argument webAuthWhiteUserIndex results in stack-based buffer overflow. The attack can be initiated remotely...
CVE-2026-90689
A stack-based buffer overflow vulnerability exists in the Tenda W20E wireless router, specifically in the formDelWebAuthWhiteUser function within firmware version 15.11.0.61068_1546_841_CN_TDC . By manipulating the webAuthWhiteUserIndex argument, an authenticated remote attacker can trigger the o...
EUVD-2026-77311
A security flaw has been discovered in Tenda W20E 15.11.0.610681546841CNTDC. Impacted is the function formDelWebAuthWhiteUser. Performing a manipulation of the argument webAuthWhiteUserIndex results in stack-based buffer overflow. The attack can be initiated remotely...
CVE-2026-90688 Tenda W20E HTTP formIPMacBindAdd stack-based overflow
A vulnerability was identified in Tenda W20E 15.11.0.610681546841CNTDC. This issue affects the function formIPMacBindAdd of the component HTTP Handler. Such manipulation of the argument IPMacBindRule leads to stack-based buffer overflow. It is possible to launch the attack remotely...
EUVD-2026-77306
A vulnerability was identified in Tenda W20E 15.11.0.610681546841CNTDC. This issue affects the function formIPMacBindAdd of the component HTTP Handler. Such manipulation of the argument IPMacBindRule leads to stack-based buffer overflow. It is possible to launch the attack remotely...
CVE-2026-90688
Tenda W20E (version 15.11.0.61068_1546_841_CN_TDC ) is affected by a stack-based buffer overflow in the function formIPMacBindAdd within the HTTP Handler component. Manipulating the IPMacBindRule argument triggers the overflow. The vulnerability is exploitable remotely with low privileges and no ...
CVE-2026-67965
An issue in Tneda W20E v.16.01.0.62782 allows a remote attacker to execute arbitrary code via the urlneedlogin function...
CVE-2026-67966
Tenda W20E V16.01.0.62782 /goform/telnet endpoint allows unauthenticated remote attackers to activate the Telnet daemon and obtain root shell access...
CVE-2026-67967
Buffer Overflow vulnerability in Tenda W20E V16.01.0.62782 allows an attacker to execute arbitrary code. This is an incomplete fix for CVE-2025-44867 and CVE-2026-36819...
CVE-2026-67965
Tenda W20E V5.0 firmware US_W20EV5.0qu_V16.01.0.6(2782)_CN&EN_TDE01.bin exposes url_need_login to bypass authentication when the admin password is empty (factory default), enabling unauthenticated activation of /goform/ate — an AES-128-CBC backdoor on UDP/7329 using hardcoded key Tenda0123456789M...
CVE-2026-67967
Buffer Overflow vulnerability in Tenda W20E V16.01.0.62782 allows an attacker to execute arbitrary code. This is an incomplete fix for CVE-2025-44867 and CVE-2026-36819...
EUVD-2026-60444
An issue in Tneda W20E v.16.01.0.62782 allows a remote attacker to execute arbitrary code via the urlneedlogin function...
EUVD-2026-60537
Buffer Overflow vulnerability in Tenda W20E V16.01.0.62782 allows an attacker to execute arbitrary code. This is an incomplete fix for CVE-2025-44867 and CVE-2026-36819...
PT-2026-76794
Name of the Vulnerable Software and Affected Versions Tenda W20E version V16.01.0.62782 Description The '/goform/telnet' endpoint allows unauthenticated remote attackers to activate the Telnet daemon, which enables them to obtain root shell access to the device. Recommendations At the moment, the...
CVE-2026-67966
The Tenda W20E V5.0 router (firmware V16.01.0.6(2782)) exposes /goform/telnet, which unconditionally starts telnetd and opens port 23 to the WAN, granting an unauthenticated, passwordless root shell. The flaw stems from manufacturing-test code retained in production firmware. No fix is available;...
CVE-2026-67967
CVE-2026-67967 is a buffer overflow (CWE-121) and command injection (CWE-78) in the /goform/module API of Tenda W20E V5.0 firmware V16.01.0.6(2782). The vendor's prior fix (CVE-2025-44867, CVE-2026-36819) left sibling handlers vulnerable: setFixTools.hostName filters only ;, &, | before popen()-e...