PT-2025-18678 · Tenda · Tenda W20E

Published 2025-05-01 · Updated 2025-05-03 · CVE-2025-44866

Positive Technologies (AI Summary)

CVSS v3.1

6.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Tenda W20E version 15.11.0.6

Description A command injection issue was found in the formSetDebugCfg function through the level parameter. This issue allows attackers to execute arbitrary commands via a manipulated request.

Recommendations For Tenda W20E version 15.11.0.6, consider disabling the formSetDebugCfg function until a patch is available to prevent exploitation via the level parameter. Restrict access to this function to minimize the risk of arbitrary command execution. Avoid using the level parameter in the affected API endpoint until the issue is resolved.

Exploit

Fix

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

CVE-2025-44866

Affected Products

Tenda W20E

References · 5

• 🔥 https://github.com/Summermu/VulnForIoT/tree/main/Tenda_W20E/formSetDebugCfg_level/readme.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-44866 · Security Note
• https://osv.dev/vulnerability/CVE-2025-44866 · Vendor Advisory
• https://twitter.com/CVEnew/status/1918568538975113434 · Twitter Post
• https://t.me/cvetracker/22849 · Telegram Post