CVE-2026-11522: Tenda W20E setPortMirror formSetPortMirror stack-based overflow

Synopsis

A stack-based buffer overflow affects the Tenda W20E router (firmware version 15.11.0.6) in the formSetPortMirror function, reachable via a crafted HTTP request to the /goform/setPortMirror endpoint. The vulnerability requires a low-privilege account and is exploitable over the network with no victim interaction needed. Successful exploitation gives an attacker full read and write access to the device and can crash or take over the running system. HarborGuard is tracking this advisory and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable endpoint is exposed over the network, so an attacker must be able to reach the device's HTTP service remotely.

• AuthenticationRequired

  A low-privilege account is sufficient; no administrative credentials are needed to reach the formSetPortMirror function.

• Victim interactionNot required

  No user action or social engineering is needed; the attacker sends a crafted request directly to the endpoint.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special conditions, race timing, or environmental setup.

Blast Radius

• A successful attacker reads sensitive configuration data and credentials stored on the device.
• The attacker can write arbitrary data to the stack, enabling control of the device's execution flow and full compromise of the router.
• The affected service crashes if the overflow is not precisely controlled, causing a denial of service for all traffic the router handles.
• Because the overflow affects the router's management process, all network traffic flowing through the device is exposed to interception or manipulation after compromise.