Description

A vulnerability was identified in Tenda W20E 15.11.0.61068_1546_841_CN_TDC. This issue affects the function formIPMacBindAdd of the component HTTP Handler. Such manipulation of the argument IPMacBindRule leads to stack-based buffer overflow. It is possible to launch the attack remotely.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-09-14T07:17:24.513Z",
  "pubdate": "2026-09-14T07:17:24.513Z",
  "executiveSummary": "A critical stack-based buffer overflow vulnerability exists in the Tenda W20E router, specifically within firmware version 15.11.0.61068_1546_841_CN_TDC.\nThe vulnerability resides in the HTTP Handler component, specifically within the formIPMacBindAdd function.\nBy manipulating the IPMacBindRule argument during an HTTP request, an unauthenticated or remote attacker can trigger a memory corruption condition.\nThe primary risk implication is potential remote code execution (RCE) with the privileges of the web server process.\nSuccessful exploitation allows an attacker to overwrite the stack, potentially hijacking the control flow of the device.\nGiven the nature of the vulnerability, it presents a significant threat to device integrity, potentially leading to unauthorized system access, denial of service (DoS), or full device compromise.",
  "technicalDetails": "The vulnerability is a classic stack-based buffer overflow triggered via the web management interface of the Tenda W20E router.\nThe affected component is the HTTP Handler, which is responsible for parsing incoming HTTP requests and processing configuration changes.\nThe vulnerable function is formIPMacBindAdd, which handles the addition of IP-MAC binding rules. The root cause of this vulnerability is the failure to perform adequate boundary checking on the user-supplied input contained within the IPMacBindRule argument before copying it into a fixed-length stack buffer.\nWhen a user submits a specially crafted HTTP request containing an excessively long IPMacBindRule, the application executes a memory copy operation—typically using unsafe functions like strcpy or sprintf—that exceeds the capacity of the destination buffer.\nThis overflow allows an attacker to overwrite critical data on the stack, including the saved return address (or saved frame pointer).\nThe attack flow proceeds as follows: First, the attacker sends a malicious HTTP request to the device targeting the function responsible for adding IP-MAC binding rules. Second, the crafted IPMacBindRule payload is passed to the formIPMacBindAdd function. Third, the function attempts to process this input without proper length validation, leading to the overflow of the stack buffer. Fourth, by carefully crafting the payload, an attacker can overwrite the function's return address on the stack to point to attacker-controlled shellcode (if DEP is absent) or redirect control flow to existing executable code snippets in the binary (Return-Oriented Programming or ROP) to bypass non-executable memory protections.\nThis vulnerability is reachable remotely over the network, as the HTTP handler is typically exposed on the management interface. Successful exploitation results in the execution of arbitrary code within the context of the web server process, leading to full system compromise or a crash of the service, resulting in a denial-of-service condition."
}