W20e Firmware (Tenda) - vulnerabilities (CVEs)

31 CVEs, 0 in the last 30 days, 5 known versions, newest CVE from 2026-09-14. Vendor: Tenda.

CVEs of W20e Firmware

CVE-2026-90689 - CVSS 8.8 (high), 2026-09-14: A security flaw has been discovered in Tenda W20E 15.11.0.61068_1546_841_CN_TDC. Impacted is the function formDelWebAuthWhiteUser. Performing a manipulation…
CVE-2026-90688 - CVSS 7.1 (high), 2026-09-14: A vulnerability was identified in Tenda W20E 15.11.0.61068_1546_841_CN_TDC. This issue affects the function formIPMacBindAdd of the component HTTP Handler.…
CVE-2026-19824 - CVSS 8.8 (high), 2026-08-14: A weakness has been identified in Tenda W20E 15.11.0.6(1068_1546_841)_CN_TDC. The affected element is the function ipMacBindListStore of the file…
CVE-2026-19823 - CVSS 8.8 (high), 2026-08-14: A security flaw has been discovered in Tenda W20E 15.11.0.6(1068_1546_841)_CN_TDC. Impacted is the function formQOSRuleDel of the file /goform/delQos of the…
CVE-2026-19822 - CVSS 8.8 (high), 2026-08-14: A vulnerability was identified in Tenda W20E 15.11.0.6(1068_1546_841)_CN_TDC. This issue affects the function lstAdd of the file /goform/editQos of the…
CVE-2026-11524 - CVSS 8.8 (high), 2026-06-08: A vulnerability has been found in Tenda W20E 15.11.0.6. Impacted is the function modifyWifiFilterRules of the file /goform/modifyWifiFilterRules of the…
CVE-2026-11523 - CVSS 8.8 (high), 2026-06-08: A flaw has been found in Tenda W20E 15.11.0.6. This issue affects the function formPortalAuth of the file /goform/PortalAuth of the component Web Management…
CVE-2026-11522 - CVSS 8.8 (high), 2026-06-08: A vulnerability was detected in Tenda W20E 15.11.0.6. This vulnerability affects the function formSetPortMirror of the file /goform/setPortMirror. Performing…
CVE-2026-24112 - CVSS 9.8 (critical), 2026-03-02: An issue was discovered in Tenda W20E V4.0br_V15.11.0.6. Attackers may exploit the vulnerability by specifying the value of `userInfo`. When `userInfo` is…
CVE-2026-24110 - CVSS 9.8 (critical), 2026-03-02: An issue was discovered in Tenda W20E V4.0br_V15.11.0.6. Attackers may send overly long `addDhcpRules` data. When these rules enter the `addDhcpRule` function…
CVE-2026-24114 - CVSS 9.8 (critical), 2026-03-02: An issue was discovered in Tenda W20E V4.0br_V15.11.0.6. Failure to validate `pPortMapIndex` may lead to buffer overflows when using `strcpy`.
CVE-2026-24108 - CVSS 9.8 (critical), 2026-03-02: An issue was discovered in Tenda W20E V4.0br_V15.11.0.6. Attackers may exploit the vulnerability by controlling the value of `nptr`. When this value is passed…
CVE-2026-24113 - CVSS 9.8 (critical), 2026-03-02: An issue was discovered in Tenda W20E V4.0br_V15.11.0.6. Attackers may exploit the vulnerability by controlling the value of `nptr`. When this value is passed…
CVE-2026-24107 - CVSS 9.8 (critical), 2026-03-02: An issue was discovered in Tenda W20E V4.0br_V15.11.0.6. Failure to validate the value of `usbPartitionName`, which is directly used in `doSystemCmd`, may…
CVE-2026-24111 - CVSS 9.8 (critical), 2026-03-02: An issue was discovered in Tenda W20E V4.0br_V15.11.0.6. Attackers may exploit the vulnerability by specifying the value of `userInfo`. When `userInfo` is…
CVE-2026-24115 - CVSS 9.8 (critical), 2026-03-02: An issue was discovered in Tenda W20E V4.0br_V15.11.0.6. Failure to validate the sizes of `gstup` and `gstdwn` before concatenating them into `gstruleQos` may…
CVE-2026-24109 - CVSS 9.8 (critical), 2026-03-02: An issue was discovered in Tenda W20E V4.0br_V15.11.0.6. Attackers may exploit the vulnerability by controlling the value of `picName`. When this value is…
CVE-2025-44866 - CVSS 6.3 (medium), 2025-05-01: Tenda W20E V15.11.0.6 was found to contain a command injection vulnerability in the formSetDebugCfg function via the level parameter. This vulnerability…
CVE-2025-44865 - CVSS 6.3 (medium), 2025-05-01: Tenda W20E V15.11.0.6 was found to contain a command injection vulnerability in the formSetDebugCfg function via the enable parameter. This vulnerability…
CVE-2025-44867 - CVSS 6.3 (medium), 2025-05-01: Tenda W20E V15.11.0.6 was found to contain a command injection vulnerability in the formSetNetCheckTools function via the hostName parameter. This…
CVE-2025-44864 - CVSS 6.3 (medium), 2025-05-01: Tenda W20E V15.11.0.6 was found to contain a command injection vulnerability in the formSetDebugCfg function via the module parameter. This vulnerability…
CVE-2024-3874 - CVSS 8.8 (high), 2024-04-16: A vulnerability was found in Tenda W20E 15.11.0.6. It has been declared as critical. This vulnerability affects the function formSetRemoteWebManage of the…
CVE-2023-26806 - CVSS 9.8 (critical), 2023-03-19: Tenda W20E v15.11.0.6(US_W20EV4.0br_v15.11.0.6(1068_1546_841 is vulnerable to Buffer Overflow via function formSetSysTime,
CVE-2023-26805 - CVSS 9.8 (critical), 2023-03-19: Tenda W20E v15.11.0.6 (US_W20EV4.0br_v15.11.0.6(1068_1546_841)_CN_TDC) is vulnerable to Buffer Overflow via function formIPMacBindModify.
CVE-2022-48130 - CVSS 9.8 (critical), 2023-02-02: Tenda W20E v15.11.0.6 was discovered to contain multiple stack overflows in the function formSetStaticRoute via the parameters staticRouteNet,…
CVE-2022-45997 - CVSS 7.2 (high), 2022-12-12: Tenda W20E V16.01.0.6(3392) is vulnerable to Buffer Overflow.
CVE-2022-45996 - CVSS 7.2 (high), 2022-12-12: Tenda W20E V16.01.0.6(3392) is vulnerable to Command injection via cmd_get_ping_output.
CVE-2022-40868 - CVSS 9.8 (critical), 2022-09-23: Tenda W20E router V15.11.0.6 (US_W20EV4.0br_V15.11.0.6(1068_1546_841)_CN_TDC) contains a stack overflow vulnerability in the function formDelDhcpRule with the…
CVE-2022-40867 - CVSS 9.8 (critical), 2022-09-23: Tenda W20E router V15.11.0.6 (US_W20EV4.0br_V15.11.0.6(1068_1546_841)_CN_TDC) contains a stack overflow vulnerability in the function formIPMacBindDel with…
CVE-2022-40866 - CVSS 9.8 (critical), 2022-09-23: Tenda W20E router V15.11.0.6 (US_W20EV4.0br_V15.11.0.6(1068_1546_841)_CN_TDC) contains a stack overflow vulnerability in the function formSetDebugCfg with…
CVE-2022-40855 - CVSS 9.8 (critical), 2022-09-23: Tenda W20E router V15.11.0.6 contains a stack overflow in the function formSetPortMapping with post request 'goform/setPortMapping/'. This vulnerability…