Tenda

W20e

27 Schwachstellen gefunden.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
9.8

CVE-2026-24115

Exploit
  • EPSS 0.69%
  • Veröffentlicht 02.03.2026 00:00:00
  • Zuletzt bearbeitet 03.03.2026 21:15:58

An issue was discovered in Tenda W20E V4.0br_V15.11.0.6. Failure to validate the sizes of `gstup` and `gstdwn` before concatenating them into `gstruleQos` may lead to buffer overflow.

9.8

CVE-2026-24108

Exploit
  • EPSS 0.65%
  • Veröffentlicht 02.03.2026 00:00:00
  • Zuletzt bearbeitet 03.03.2026 15:54:49

An issue was discovered in Tenda W20E V4.0br_V15.11.0.6. Attackers may exploit the vulnerability by controlling the value of `nptr`. When this value is passed into the `getMibPrefix` function and concatenated using `sprintf` without proper size valid...

9.8

CVE-2026-24107

Exploit
  • EPSS 2.16%
  • Veröffentlicht 02.03.2026 00:00:00
  • Zuletzt bearbeitet 03.03.2026 15:55:11

An issue was discovered in Tenda W20E V4.0br_V15.11.0.6. Failure to validate the value of `usbPartitionName`, which is directly used in `doSystemCmd`, may lead to critical command injection vulnerabilities.

6.3

CVE-2025-44864

Exploit
  • EPSS 1.09%
  • Veröffentlicht 01.05.2025 00:00:00
  • Zuletzt bearbeitet 27.05.2025 16:44:36

Tenda W20E V15.11.0.6 was found to contain a command injection vulnerability in the formSetDebugCfg function via the module parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request.

6.3

CVE-2025-44867

Exploit
  • EPSS 1.09%
  • Veröffentlicht 01.05.2025 00:00:00
  • Zuletzt bearbeitet 27.05.2025 16:31:11

Tenda W20E V15.11.0.6 was found to contain a command injection vulnerability in the formSetNetCheckTools function via the hostName parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request.

6.3

CVE-2025-44866

Exploit
  • EPSS 1.09%
  • Veröffentlicht 01.05.2025 00:00:00
  • Zuletzt bearbeitet 27.05.2025 16:44:21

Tenda W20E V15.11.0.6 was found to contain a command injection vulnerability in the formSetDebugCfg function via the level parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request.

6.3

CVE-2025-44865

Exploit
  • EPSS 1.09%
  • Veröffentlicht 01.05.2025 00:00:00
  • Zuletzt bearbeitet 27.05.2025 16:44:28

Tenda W20E V15.11.0.6 was found to contain a command injection vulnerability in the formSetDebugCfg function via the enable parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request.