Description

A security flaw has been discovered in Tenda W20E 15.11.0.6(1068_1546_841)_CN_TDC. Impacted is the function formQOSRuleDel of the file /goform/delQos of the component QoS Rule Deletion. Performing a manipulation of the argument qosIndex results in stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-14T13:17:37.763Z",
  "pubdate": "2026-08-14T13:17:37.763Z",
  "executiveSummary": "A critical security flaw has been identified in the Tenda W20E router running firmware version 15.11.0.6(1068_1546_841)_CN_TDC. The vulnerability is classified as a stack-based buffer overflow, residing within the QoS Rule Deletion component. Specifically, the flaw affects the function formQosRuleDel when processing HTTP requests sent to the endpoint /goform/delQos.\nThe primary risk associated with this vulnerability is remote code execution or denial of service affecting the targeted networking device. An unauthenticated remote attacker can exploit this security flaw by supplying a specially crafted payload within the vulnerable qosIndex argument during the QoS rule deletion process. Successful exploitation compromises the integrity, availability, and potentially the confidentiality of the affected device, allowing unauthorized remote control over the underlying operating system.\nGiven that public exploit code has already been released, the threat landscape is elevated, requiring immediate defensive measures. Exploitation requires network access to the administrative or management interface of the router, but does not explicitly require prior authentication based on the provided vulnerability mechanics.",
  "technicalDetails": "The vulnerability is a stack-based buffer overflow stemming from unsafe handling of input parameters within the QoS Rule Deletion functionality of the Tenda W20E firmware version 15.11.0.6(1068_1546_841)_CN_TDC. The vulnerable code path is localized to the function formQosRuleDel, which processes incoming requests directed at the URI /goform/delQos.\nThe root cause of the vulnerability lies in inadequate bounds checking and improper validation of the qosIndex argument supplied by the user via HTTP request parameters. When formQosRuleDel processes the qosIndex parameter, it copies the supplied data into a fixed-size stack buffer without verifying whether the input length exceeds the allocated buffer capacity. This architectural oversight allows an attacker to supply an excessively long string designed to overflow the stack frame.\nThe attack flow proceeds as follows: First, an attacker crafts a malicious HTTP request targeting the /goform/delQos endpoint. The request includes an oversized payload injected into the qosIndex parameter. Second, the web server daemon parses the incoming request and passes the untrusted input directly to the formQosRuleDel function. Third, the function executes an unsafe copy operation, copying the oversized qosIndex value into the vulnerable stack buffer. Finally, the excessive data overflows the stack, overwriting adjacent memory structures, including saved frame pointers and return addresses.\nBy carefully structuring the overflow payload, a remote attacker can hijack the execution flow of the application. This enables the execution of arbitrary machine code or shellcode with the privileges of the web server or underlying daemon. Because the vulnerability is exposed via the network-facing web management interface, remote exploitation is fully feasible without requiring prior authentication or administrative privileges. Post-exploitation impact includes complete device compromise, persistent firmware manipulation, disruption of routing services, or pivoting into the internal local area network."
}