PT-2026-22601 · Tenda · Tenda W20E

Akuma-Qaq · Published 2026-03-02 · Updated 2026-03-07 · CVE-2026-24111

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Tenda W20E version 4.0br V15.11.0.6

Description An issue exists in Tenda W20E firmware where improper input validation can lead to a buffer overflow. Attackers can exploit this by manipulating the userInfo variable. Specifically, when the userInfo value is passed to the addAuthUser function and processed by the sscanf function without sufficient size validation, a buffer overflow can occur.

Recommendations Update to a newer version of Tenda W20E firmware that addresses this vulnerability.

Exploit

Fix

Buffer Overflow

Weakness Enumeration

CWE-120

Related Identifiers

BDU:2026-02501

CVE-2026-24111

Affected Products

Tenda W20E

References · 12

• 🔥 https://github.com/akuma-QAQ/CVEreport/tree/main/D-link/CVE-2026-24111 · Exploit
• https://osv.dev/vulnerability/CVE-2026-24111 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-02501 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-24111 · Security Note
• https://twitter.com/cracbot/status/2029512353369465193 · Twitter Post
• https://t.me/cveNotify/153962 · Telegram Post
• https://twitter.com/CVEnew/status/2028500221714444470 · Twitter Post
• https://twitter.com/cracbot/status/2030237108917690517 · Twitter Post
• https://tenda.com.cn/material/show/2707 · Note
• https://twitter.com/infoflowcloud/status/2028502179615592776 · Twitter Post
• https://twitter.com/cracbot/status/2029874810118082955 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2028519726389830140 · Twitter Post