Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-19822: Tenda W20E QoS Edit Remote Stack Overflow

CVE-2026-19822 · published 2 months ago

Summary

A bug in the Tenda W20E's Quality of Service (QoS) editing feature can be exploited by hackers to execute malicious code remotely. This could allow an attacker to take control of the router. Users of the Tenda W20E should update their device to the latest firmware version to fix this issue.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
tenda	w20e	15.11.0.6(1068_1546_841)_CN_TDC

Original advisory text

A vulnerability was identified in Tenda W20E 15.11.0.6(1068_1546_841)_CN_TDC. This issue affects the function lstAdd of the file /goform/editQos of the component QoS Edit. Such manipulation of the argument qosListConnecttedNum leads to stack-based buffer overflow. The attack may be launched remotely. The exploit is publicly available and might be used.

References

https://vuldb.com/vuln/389955 vdb-entry technical-description
https://vuldb.com/vuln/389955/cti signature permissions-required
https://vuldb.com/cve/CVE-2026-19822 third-party-advisory
https://vuldb.com/submit/869006 third-party-advisory
https://github.com/paueger/mycve/blob/main/Tenda_W20E/3.md exploit
https://www.tenda.com.cn/ product

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker full control

Severity

7.4 High

Exploitation

<1% chance of attack within 30 days

Type

CWE-121Stack-based Buffer Overflow

CWE-119Buffer Overflow

Timeline

Published14 Aug 2026

Updated3 Nov 2026

First seen14 Aug 2026

Sources

CVE-2026-19822 · NVD

CVE-2026-19822 · MITRE

Track software like this

Free during beta