CVE-2026-11524: Tenda W20E Web Management modifyWifiFilterRules stack-based overflow

Synopsis

A stack-based buffer overflow exists in the Tenda W20E router (firmware version 15.11.0.6) within the modifyWifiFilterRules function of the web management interface. The vulnerability is reachable over the network by any authenticated user and is triggered by sending an oversized value in the wifiFilterListRemark argument to the /goform/modifyWifiFilterRules endpoint. Successful exploitation gives an attacker full control of memory execution flow, enabling remote code execution, data disclosure, or complete service disruption on the device. HarborGuard is tracking this advisory and will make a patched-image rebuild available as soon as an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable endpoint is exposed over the network through the web management interface, so an attacker must be able to reach the device's HTTP/HTTPS management port.

• AuthenticationRequired

  The CVSS vector specifies low-privilege credentials (PR:L), meaning any valid low-privilege account on the management interface is sufficient to send the malicious request.

• Victim interactionNot required

  No user interaction is needed; the attacker sends a crafted HTTP request directly to the endpoint without requiring any action from another user.

• Attack complexityDetail

  Attack complexity is low (AC:L), meaning the exploit is reliable and requires no special timing, race conditions, or environmental configuration beyond reaching the endpoint with valid credentials.

Blast Radius

• Reads configuration data, credentials, and any secrets stored in the device memory or management interface session (VC:H).
• Modifies device configuration, Wi-Fi filter rules, and network policy settings persisted on the router (VI:H).
• Crashes the web management service or the underlying device firmware, causing a loss of management access and potential network outage (VA:H).
• Enables arbitrary code execution in the router's process context, allowing an attacker to install persistent backdoors or pivot to adjacent network segments managed by the device.