PT-2026-22610 · Tenda · Tenda W20E

Akuma-Qaq · Published 2026-03-02 · Updated 2026-03-07 · CVE-2026-24110

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Tenda W20E version 4.0br V15.11.0.6

Description A buffer overflow issue exists in the Tenda W20E. The issue occurs due to insufficient size validation when processing overly long addDhcpRules data. Specifically, the addDhcpRule function uses sscanf to process the rules, and the lack of validation for dhcpsIndex, dhcpsIP, and dhcpsMac can lead to buffer overflows. The vulnerable function is addDhcpRule. The sscanf function is used with the format string " %dt%[^t]t%[^ rt]".

Recommendations Update to a newer version that contains a fix for this vulnerability.

Exploit

Fix

Buffer Overflow

Weakness Enumeration

CWE-120

Related Identifiers

CVE-2026-24110

Affected Products

Tenda W20E

References · 9

• 🔥 https://github.com/akuma-QAQ/CVEreport/tree/main/D-link/CVE-2026-24110 · Exploit
• https://osv.dev/vulnerability/CVE-2026-24110 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-24110 · Security Note
• https://twitter.com/cracbot/status/2029874845660647921 · Twitter Post
• https://t.me/cveNotify/153966 · Telegram Post
• https://twitter.com/vuldb/status/2028501646691704945 · Twitter Post
• https://twitter.com/cracbot/status/2029512385766264969 · Twitter Post
• https://twitter.com/cracbot/status/2030237139909410846 · Twitter Post
• https://tenda.com.cn/material/show/2707 · Note