Description

A security flaw has been discovered in Tenda W20E 15.11.0.61068_1546_841_CN_TDC. Impacted is the function formDelWebAuthWhiteUser. Performing a manipulation of the argument webAuthWhiteUserIndex results in stack-based buffer overflow. The attack can be initiated remotely.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-09-14T07:17:24.700Z",
  "pubdate": "2026-09-14T07:17:24.700Z",
  "executiveSummary": "A critical stack-based buffer overflow vulnerability has been identified in the Tenda W20E router, specifically within the firmware version 15.11.0.61068_1546_841_CN_TDC.\nThe vulnerability resides in the formDelWebAuthWhiteUser function, which improperly handles input provided to the webAuthWhiteUserIndex argument.\nThis flaw allows a remote, unauthenticated attacker to inject malicious data into the application's memory space, potentially leading to arbitrary code execution or a denial-of-service condition.\nDue to the nature of stack-based overflows, successful exploitation can result in the subversion of control flow, enabling an attacker to execute unauthorized commands with the privileges of the affected service.\nGiven the remote accessibility of the device's web management interface, the risk implication is high, necessitating immediate defensive measures to prevent exploitation.",
  "technicalDetails": "The vulnerability is a classic stack-based buffer overflow occurring within the formDelWebAuthWhiteUser function of the Tenda W20E firmware (version 15.11.0.61068_1546_841_CN_TDC).\nThe root cause stems from insufficient boundary checking on the webAuthWhiteUserIndex argument provided by a user request. The application fails to validate the size of the input before copying it into a fixed-size stack buffer.\nWhen a specially crafted payload is submitted via the webAuthWhiteUserIndex parameter, the data overflows the allocated buffer, overwriting adjacent memory locations on the stack, including the return address or saved frame pointer.\nThe attack flow begins with an attacker sending a maliciously crafted HTTP request containing an oversized webAuthWhiteUserIndex value to the vulnerable endpoint handled by the formDelWebAuthWhiteUser function.\nBecause the function does not perform adequate bounds checking, the excess data spills over into memory areas intended for control flow management. By precisely manipulating the payload, an attacker can overwrite the function's return address to redirect execution flow to an arbitrary memory location.\nThis can be leveraged to execute shellcode injected as part of the payload or to perform a return-oriented programming (ROP) attack to bypass common memory protection mechanisms if they are present.\nThe impact of this vulnerability is severe, as it facilitates remote code execution (RCE) on the affected router. Successful exploitation grants the attacker the ability to execute arbitrary commands, potentially leading to a full compromise of the device, interception of network traffic, or use of the device in further malicious activities within the local network.\nThe vulnerability is exposed through the network-facing web management interface. No authentication is typically required to reach the vulnerable code path, significantly increasing the attack surface and ease of exploitation for remote adversaries."
}