Tenda W20E vulnerabilities, page 2
31 vulnerabilities
Known vulnerabilities in Tenda W20E, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
CriticalCVE-2026-24113tenda · w20e_firmwaretenda w20e_firmwareAn issue was discovered in Tenda W20E V4.0br_V15.11.0.6. Attackers may exploit the vulnerability by controlling the value of `nptr`. When this value is passed into the `getMibPrefix` function and concatenated using `sprintf` without proper size validation, it could lead to a buffer overflow vulnerability.EPSS0.68%CriticalCVE-2026-24114tenda · w20e_firmwaretenda w20e_firmwareAn issue was discovered in Tenda W20E V4.0br_V15.11.0.6. Failure to validate `pPortMapIndex` may lead to buffer overflows when using `strcpy`.EPSS0.65%CriticalCVE-2026-24108tenda · w20e_firmwaretenda w20e_firmwareAn issue was discovered in Tenda W20E V4.0br_V15.11.0.6. Attackers may exploit the vulnerability by controlling the value of `nptr`. When this value is passed into the `getMibPrefix` function and concatenated using `sprintf` without proper size validation, it could lead to a buffer overflow vulnerability.EPSS0.68%CriticalCVE-2026-24107tenda · w20e_firmwaretenda w20e_firmwareAn issue was discovered in Tenda W20E V4.0br_V15.11.0.6. Failure to validate the value of `usbPartitionName`, which is directly used in `doSystemCmd`, may lead to critical command injection vulnerabilities.EPSS2.25%CriticalCVE-2026-24110tenda · w20e_firmwaretenda w20e_firmwareAn issue was discovered in Tenda W20E V4.0br_V15.11.0.6. Attackers may send overly long `addDhcpRules` data. When these rules enter the `addDhcpRule` function and are processed by `ret = sscanf(pRule, " %d\t%[^\t]\t%[^\n\r\t]", &dhcpsIndex, dhcpsIP, dhcpsMac);`, the lack of size validation for the rules could lead to buffer overflows in `dhcpsIndex`, `dhcpsIP`, and `dhcpsMac`.EPSS0.44%CriticalCVE-2026-24111tenda · w20e_firmwaretenda w20e_firmwareAn issue was discovered in Tenda W20E V4.0br_V15.11.0.6. Attackers may exploit the vulnerability by specifying the value of `userInfo`. When `userInfo` is passed into the `addAuthUser` function and processed by `sscanf` without size validation, it could lead to buffer overflow.EPSS0.68%CriticalCVE-2026-24115tenda · w20e_firmwaretenda w20e_firmwareAn issue was discovered in Tenda W20E V4.0br_V15.11.0.6. Failure to validate the sizes of `gstup` and `gstdwn` before concatenating them into `gstruleQos` may lead to buffer overflow.EPSS0.72%CriticalCVE-2026-24112tenda · w20e_firmwaretenda w20e_firmwareAn issue was discovered in Tenda W20E V4.0br_V15.11.0.6. Attackers may exploit the vulnerability by specifying the value of `userInfo`. When `userInfo` is passed into the `addWewifiWhiteUser` function and processed by `sscanf` without size validation, it could lead to a buffer overflow vulnerability.EPSS0.56%CriticalCVE-2026-24109tenda · w20e_firmwaretenda w20e_firmwareAn issue was discovered in Tenda W20E V4.0br_V15.11.0.6. Attackers may exploit the vulnerability by controlling the value of `picName`. When this value is used in `sprintf` without validating variable sizes, it could lead to a buffer overflow vulnerability.EPSS0.68%CriticalCVE-2023-26806tenda · w20e_firmwaretenda w20e_firmwareTenda W20E v15.11.0.6(US_W20EV4.0br_v15.11.0.6(1068_1546_841 is vulnerable to Buffer Overflow via function formSetSysTime,EPSS0.93%CriticalCVE-2023-26805tenda · w20e_firmwaretenda w20e_firmwareTenda W20E v15.11.0.6 (US_W20EV4.0br_v15.11.0.6(1068_1546_841)_CN_TDC) is vulnerable to Buffer Overflow via function formIPMacBindModify.EPSS0.93%