PT-2026-22594 · Tenda · Tenda W20E

Akuma-Qaq · Published 2026-03-02 · Updated 2026-03-07 · CVE-2026-24107

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Tenda W20E version 4.0br V15.11.0.6

Description A command injection issue exists in the Tenda W20E router firmware. The firmware does not properly validate the usbPartitionName variable before using it within the doSystemCmd function. This can allow for the execution of arbitrary commands.

Recommendations Update to a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict access to the USB partition functionality to minimize the risk of exploitation.

Exploit

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

BDU:2026-02499

CVE-2026-24107

Affected Products

Tenda W20E

References · 11

• 🔥 https://github.com/akuma-QAQ/CVEreport/tree/main/D-link/CVE-2026-24107 · Exploit
• https://osv.dev/vulnerability/CVE-2026-24107 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-02499 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-24107 · Security Note
• https://twitter.com/cracbot/status/2030237103943270727 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2028532523005784367 · Twitter Post
• https://twitter.com/cracbot/status/2029512348231434598 · Twitter Post
• https://twitter.com/cracbot/status/2029874804652921137 · Twitter Post
• https://tenda.com.cn/material/show/2707 · Note
• https://t.me/cveNotify/153959 · Telegram Post
• https://t.me/cveNotify/153877 · Telegram Post