CVE-2022-40855: Tenda w20e Firmware

Critical severity, CVSS 9.8. EPSS: 14.1% chance of exploitation in the next 30 days.

Tenda W20E router V15.11.0.6 contains a stack overflow in the function formSetPortMapping with post request 'goform/setPortMapping/'. This vulnerability allows attackers to cause a Denial of Service (DoS) or Remote Code Execution (RCE) via the portMappingServer, portMappingProtocol, portMappingWan, porMappingtInternal, and portMappingExternal parameters.

Affected products

• Tenda w20e Firmware: version 15.11.0.6 only

Published 2022-09-23. Last modified 2026-06-17.