Description

A weakness has been identified in Tenda W20E 15.11.0.6(1068_1546_841)_CN_TDC. The affected element is the function ipMacBindListStore of the file /goform/addIpMacBind. Executing a manipulation of the argument IPMacBindRule can lead to stack-based buffer overflow. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-14T13:17:37.960Z",
  "pubdate": "2026-08-14T13:17:37.960Z",
  "executiveSummary": "A stack-based buffer overflow vulnerability has been identified within the firmware of the Tenda W20E router, specifically affecting version 15.11.0.6(1068_1546_841)_CN_TDC. The flaw resides in the handling of the IPMacBindRule argument processed by the ipMacBindListStore function located in the /goform/addIpMacBind endpoint. This vulnerability allows remote unauthenticated attackers to supply overly long input strings that exceed the bounds of the allocated stack buffer during the parsing process. Successful exploitation of this weakness results in memory corruption, potentially leading to arbitrary code execution, system instability, or complete denial of service of the affected routing device. The availability of public exploit materials significantly elevates the risk level, enabling threat actors to execute attacks remotely across network boundaries without requiring prior authentication or privileged access. Remediation is critical to prevent device takeover and potential lateral movement within the local network infrastructure.",
  "technicalDetails": "The vulnerability is classified as a stack-based buffer overflow stemming from unsafe memory handling operations within the binary executable of the Tenda W20E router. The root cause lies in the ipMacBindListStore function located in the web management binary handling the /goform/addIpMacBind URI path. When processing incoming HTTP requests, the function retrieves user-supplied input from the IPMacBindRule parameter. Due to an absence of adequate boundary checks, input length validation, or sanitization routines prior to copy operations, the function copies the untrusted data directly into a fixed-size stack buffer. Because the destination buffer cannot accommodate strings that exceed its predefined capacity, the excess data overflows the stack boundaries, overwriting adjacent memory regions such as saved frame pointers and return addresses. Exploitation of this vulnerability occurs remotely over the network by sending a maliciously crafted HTTP POST or GET request containing an excessively long payload within the IPMacBindRule parameter to the /goform/addIpMacBind endpoint. As the ipMacBindListStore function processes the oversized input, the stack is corrupted, allowing the attacker to hijack the instruction pointer upon function return. Depending on the architecture and applied binary protections, this enables the execution of arbitrary shellcode or Return-Oriented Programming (ROP) chains. The affected product is Tenda W20E running version 15.11.0.6(1068_1546_841)_CN_TDC. The attack vector is fully remote, requires no authentication, and can be initiated by any network-adjacent entity capable of reaching the device's web management interface. Post-exploitation impact includes full system compromise, persistent denial of service via continuous device crashes, or manipulation of network traffic routing rules."
}