Tenda W20E Firmware Allows Long Data to Cause Buffer Overflow

Summary

The Tenda W20E's DHCP configuration feature is vulnerable to a buffer overflow attack. An attacker can send a long string of data to the device, potentially causing it to crash or execute malicious code. To protect your network, update to the latest firmware version available from the manufacturer.

What to do

No fix is available yet. Check with your software vendor for updates.

Affected software

Vendor	Product	Affected versions	Fix available
tenda	w20e_firmware	15.11.0.6	–

Original title

An issue was discovered in Tenda W20E V4.0br_V15.11.0.6. Attackers may send overly long `addDhcpRules` data. When these rules enter the `addDhcpRule` function and are processed by `ret = sscanf(pRu...

Original description

An issue was discovered in Tenda W20E V4.0br_V15.11.0.6. Attackers may send overly long `addDhcpRules` data. When these rules enter the `addDhcpRule` function and are processed by `ret = sscanf(pRule, " %d\t%[^\t]\t%[^\n\r\t]", &dhcpsIndex, dhcpsIP, dhcpsMac);`, the lack of size validation for the rules could lead to buffer overflows in `dhcpsIndex`, `dhcpsIP`, and `dhcpsMac`.

nvd CVSS3.1 9.8

Vulnerability type

CWE-120 Classic Buffer Overflow

https://github.com/akuma-QAQ/CVEreport/tree/main/D-link/CVE-2026-24110 Exploit Third Party Advisory
https://www.tenda.com.cn/material/show/2707 Product