CVE-2025-44866: Tenda w20e Firmware

Medium severity, CVSS 6.3. EPSS: 1.2% chance of exploitation in the next 30 days.

Tenda W20E V15.11.0.6 was found to contain a command injection vulnerability in the formSetDebugCfg function via the level parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request.

Affected products

• Tenda w20e Firmware: version 15.11.0.6 only

Published 2025-05-01. Last modified 2026-06-17.