Description

A vulnerability was identified in Tenda W20E 15.11.0.6(1068_1546_841)_CN_TDC. This issue affects the function lstAdd of the file /goform/editQos of the component QoS Edit. Such manipulation of the argument qosListConnecttedNum leads to stack-based buffer overflow. The attack may be launched remotely. The exploit is publicly available and might be used.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-14T12:16:43.577Z",
  "pubdate": "2026-08-14T12:16:43.577Z",
  "executiveSummary": "A critical stack-based buffer overflow vulnerability has been identified in the QoS Edit component of Tenda W20E firmware version 15.11.0.6(1068_1546_841)_CN_TDC. Specifically, the flaw resides in the lstAdd function handling the /goform/editQos endpoint. An attacker can exploit this vulnerability by manipulating the qosListConnecttedNum parameter.\nThe primary impact of this security flaw is remote code execution, system instability, and potential complete device compromise. Because a public exploit is currently available, the risk implications are critically high, as malicious actors can leverage existing exploit code to target exposed interfaces.\nThe attack can be launched remotely over the network without requiring prior authentication, depending on the exposure of the administrative or management interface. The vulnerability stems from improper bounds checking on user-supplied input before copying it into a fixed-size stack buffer, allowing memory corruption through crafted HTTP requests.",
  "technicalDetails": "The vulnerability is a classic stack-based buffer overflow located within the lstAdd function of the binary handling the /goform/editQos URL endpoint in the QoS Edit component of the Tenda W20E router. The affected software version is 15.11.0.6(1068_1546_841)_CN_TDC.\nThe root cause of the vulnerability is the unsafe processing of the HTTP request parameter qosListConnecttedNum. When the application parses incoming requests to update Quality of Service configurations, the lstAdd function copies the value provided in qosListConnecttedNum directly into a local stack buffer without adequately verifying its length or size against the destination buffer bounds.\nThe attack flow proceeds as follows: First, an attacker crafts a malicious HTTP request targeting the /goform/editQos endpoint. Within this request, the attacker supplies an oversized string payload mapped to the qosListConnecttedNum parameter. Second, the web server daemon parses the request and invokes the vulnerable lstAdd function. Third, the function attempts to copy the excessive input data into the bounded stack buffer using unsafe string manipulation routines (such as strcpy or sprintf). Fourth, the incoming data exceeds the allocated stack space, overwriting adjacent stack memory, which typically includes the saved frame pointer and the return address.\nBy carefully crafting the payload, the attacker can hijack the control flow of the execution thread upon function return, redirecting execution to malicious shellcode or leveraging Return-Oriented Programming (ROP) chains. Network exposure is high if the management interface is accessible from the WAN or an untrusted local area network. No authentication or high privileges are strictly required if the endpoint processes unauthenticated or poorly authenticated sessions, facilitating remote exploitation."
}