← back
CVE-2026-11524

Tenda W20E Web Management modifyWifiFilterRules stack-based overflow

CVSS 8.7 HIGHEPSS 0.5%CWE-119CWE-121
Vexday Risk Score
41Attention
SSVC decision (CISA)
Attend
PoC available → attend closely
CVSS 8.7EPSS 0.5%KEV nãoPoC públicaNuclei —Metasploit —Patch —
Lifecycle
08 Jun 2026Published on NVD
Recommendation: Plan a near-term fix — a public PoC already exists.
A vulnerability has been found in Tenda W20E 15.11.0.6. Impacted is the function modifyWifiFilterRules of the file /goform/modifyWifiFilterRules of the component Web Management Interface. The manipulation of the argument wifiFilterListRemark leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Affected products
Tenda · W20E
public PoCs found — 1
cve_referencegithub.com/Robots10/IoT_vlu/blob/main/reports/Tenda/formWifiFilterRulesModify/modifyWifiFilterRules.mdunverified
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →
References
https://github.com/Robots10/IoT_vlu/blob/main/reports/Tenda/formWifiFilterRulesModify/modifyWifiFilterRules.mdhttps://vuldb.com/cve/CVE-2026-11524https://vuldb.com/submit/836478https://vuldb.com/vuln/369144https://vuldb.com/vuln/369144/ctihttps://www.tenda.com.cn/