Tenda w20e Firmware vulnerabilities

23 CVEs affecting Tenda w20e Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-24112, published 2026-03-02.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2022-40855, published 2022-09-23. Critical severity, CVSS 9.8. EPSS: 14.1% chance of exploitation in the next 30 days. Tenda W20E router V15.11.0.6 contains a stack overflow in the function formSetPortMapping with post request 'goform/setPortMapping/'. This vulnerability allows attackers to cause a Denial of Service…
CVE-2022-45996, published 2022-12-12. High severity, CVSS 7.2. EPSS: 2.3% chance of exploitation in the next 30 days. Tenda W20E V16.01.0.6(3392) is vulnerable to Command injection via cmd_get_ping_output.
CVE-2026-24107, published 2026-03-02. Critical severity, CVSS 9.8. EPSS: 2.2% chance of exploitation in the next 30 days. An issue was discovered in Tenda W20E V4.0br_V15.11.0.6. Failure to validate the value of `usbPartitionName`, which is directly used in `doSystemCmd`, may lead to critical command injection…
CVE-2024-3874, published 2024-04-16. High severity, CVSS 8.8. EPSS: 1.3% chance of exploitation in the next 30 days. A vulnerability was found in Tenda W20E 15.11.0.6. It has been declared as critical. This vulnerability affects the function formSetRemoteWebManage of the file /goform/SetRemoteWebManage. The…
CVE-2025-44867, published 2025-05-01. Medium severity, CVSS 6.3. EPSS: 1.2% chance of exploitation in the next 30 days. Tenda W20E V15.11.0.6 was found to contain a command injection vulnerability in the formSetNetCheckTools function via the hostName parameter. This vulnerability allows attackers to execute arbitrary…
CVE-2022-40868, published 2022-09-23. Critical severity, CVSS 9.8. EPSS: 1.2% chance of exploitation in the next 30 days. Tenda W20E router V15.11.0.6 (US_W20EV4.0br_V15.11.0.6(1068_1546_841)_CN_TDC) contains a stack overflow vulnerability in the function formDelDhcpRule with the request /goform/delDhcpRules/
CVE-2022-40867, published 2022-09-23. Critical severity, CVSS 9.8. EPSS: 1.2% chance of exploitation in the next 30 days. Tenda W20E router V15.11.0.6 (US_W20EV4.0br_V15.11.0.6(1068_1546_841)_CN_TDC) contains a stack overflow vulnerability in the function formIPMacBindDel with the request /goform/delIpMacBind/
CVE-2022-40866, published 2022-09-23. Critical severity, CVSS 9.8. EPSS: 1.2% chance of exploitation in the next 30 days. Tenda W20E router V15.11.0.6 (US_W20EV4.0br_V15.11.0.6(1068_1546_841)_CN_TDC) contains a stack overflow vulnerability in the function formSetDebugCfg with request /goform/setDebugCfg/
CVE-2025-44866, published 2025-05-01. Medium severity, CVSS 6.3. EPSS: 1.2% chance of exploitation in the next 30 days. Tenda W20E V15.11.0.6 was found to contain a command injection vulnerability in the formSetDebugCfg function via the level parameter. This vulnerability allows attackers to execute arbitrary commands…
CVE-2025-44865, published 2025-05-01. Medium severity, CVSS 6.3. EPSS: 1.2% chance of exploitation in the next 30 days. Tenda W20E V15.11.0.6 was found to contain a command injection vulnerability in the formSetDebugCfg function via the enable parameter. This vulnerability allows attackers to execute arbitrary…

Latest

CVE-2026-24112, published 2026-03-02. Critical severity, CVSS 9.8. EPSS: 0.6% chance of exploitation in the next 30 days. An issue was discovered in Tenda W20E V4.0br_V15.11.0.6. Attackers may exploit the vulnerability by specifying the value of `userInfo`. When `userInfo` is passed into the `addWewifiWhiteUser`…
CVE-2026-24110, published 2026-03-02. Critical severity, CVSS 9.8. EPSS: 0.4% chance of exploitation in the next 30 days. An issue was discovered in Tenda W20E V4.0br_V15.11.0.6. Attackers may send overly long `addDhcpRules` data. When these rules enter the `addDhcpRule` function and are processed by `ret =…
CVE-2026-24115, published 2026-03-02. Critical severity, CVSS 9.8. EPSS: 0.7% chance of exploitation in the next 30 days. An issue was discovered in Tenda W20E V4.0br_V15.11.0.6. Failure to validate the sizes of `gstup` and `gstdwn` before concatenating them into `gstruleQos` may lead to buffer overflow.
CVE-2026-24114, published 2026-03-02. Critical severity, CVSS 9.8. EPSS: 0.6% chance of exploitation in the next 30 days. An issue was discovered in Tenda W20E V4.0br_V15.11.0.6. Failure to validate `pPortMapIndex` may lead to buffer overflows when using `strcpy`.
CVE-2026-24113, published 2026-03-02. Critical severity, CVSS 9.8. EPSS: 0.7% chance of exploitation in the next 30 days. An issue was discovered in Tenda W20E V4.0br_V15.11.0.6. Attackers may exploit the vulnerability by controlling the value of `nptr`. When this value is passed into the `getMibPrefix` function and…
CVE-2026-24111, published 2026-03-02. Critical severity, CVSS 9.8. EPSS: 0.7% chance of exploitation in the next 30 days. An issue was discovered in Tenda W20E V4.0br_V15.11.0.6. Attackers may exploit the vulnerability by specifying the value of `userInfo`. When `userInfo` is passed into the `addAuthUser` function and…
CVE-2026-24109, published 2026-03-02. Critical severity, CVSS 9.8. EPSS: 0.7% chance of exploitation in the next 30 days. An issue was discovered in Tenda W20E V4.0br_V15.11.0.6. Attackers may exploit the vulnerability by controlling the value of `picName`. When this value is used in `sprintf` without validating…
CVE-2026-24108, published 2026-03-02. Critical severity, CVSS 9.8. EPSS: 0.7% chance of exploitation in the next 30 days. An issue was discovered in Tenda W20E V4.0br_V15.11.0.6. Attackers may exploit the vulnerability by controlling the value of `nptr`. When this value is passed into the `getMibPrefix` function and…