Description
A weakness has been identified in Tenda W20E 15.11.0.6(1068_1546_841)_CN_TDC. The affected element is the function ipMacBindListStore of the file /goform/addIpMacBind. Executing a manipulation of the argument IPMacBindRule can lead to stack-based buffer overflow. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks.
Published: 2026-08-14
Score: 8.7 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A stack-based buffer overflow has been discovered in the ipMacBindListStore function of the Tenda W20E firmware 15.11.0.6(1068_1546_841)_CN_TDC. The vulnerability is exposed through manipulation of the IPMacBindRule argument in the /goform/addIpMacBind endpoint. Exploitation of this flaw can lead to arbitrary code execution on the device, compromising its confidentiality, integrity, and availability. The weakness is categorized as CWE-119 and CWE-121, both involving unsafe buffer handling and stack-based overflows.

Affected Systems

The affected device is the Tenda W20E router. Vulnerable firmware versions include 15.11.0.6(1068_1546_841)_CN_TDC; no other firmware or model information is provided in the entry.

Risk and Exploitability

The CVSS score of 8.7 indicates high severity. No EPSS data is available, but the publicly released exploit and the ability to attack remotely raise the likelihood of real-world exploitation. The vulnerability is not listed in CISA KEV, but the public availability of an exploit suggests an urgent need to address the flaw.

Generated by OpenCVE AI on August 14, 2026 at 14:20 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update the router to the latest firmware version that incorporates the fix for the stack-based overflow.
  • Restrict remote access to the /goform/addIpMacBind endpoint by configuring the router’s firewall or access control lists to block or limit external requests.
  • If possible, disable or remove the IP-MAC binding feature through the router’s administrative interface to eliminate the vulnerable function until an official patch is applied.

Generated by OpenCVE AI on August 14, 2026 at 14:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 14 Aug 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Fri, 14 Aug 2026 13:45:00 +0000

Type Values Removed Values Added
First Time appeared Tenda w20e
Vendors & Products Tenda w20e

Fri, 14 Aug 2026 12:45:00 +0000

Type Values Removed Values Added
Description A weakness has been identified in Tenda W20E 15.11.0.6(1068_1546_841)_CN_TDC. The affected element is the function ipMacBindListStore of the file /goform/addIpMacBind. Executing a manipulation of the argument IPMacBindRule can lead to stack-based buffer overflow. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks.
Title Tenda W20E addIpMacBind ipMacBindListStore stack-based overflow
First Time appeared Tenda
Tenda w20e Firmware
Weaknesses CWE-119
CWE-121
CPEs cpe:2.3:o:tenda:w20e_firmware:*:*:*:*:*:*:*:*
Vendors & Products Tenda
Tenda w20e Firmware
References
Metrics cvssV2_0

{'score': 9, 'vector': 'AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 8.8, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Tenda W20e W20e Firmware
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-08-14T15:02:02.160Z

Reserved: 2026-08-14T05:30:23.439Z

Link: CVE-2026-19824

cve-icon Vulnrichment

Updated: 2026-08-14T15:01:21.219Z

cve-icon NVD

Status : Deferred

Published: 2026-08-14T13:17:37.960

Modified: 2026-08-14T19:09:39.140

Link: CVE-2026-19824

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-14T14:30:17Z

Weaknesses
  • CWE-119

    Improper Restriction of Operations within the Bounds of a Memory Buffer

  • CWE-121

    Stack-based Buffer Overflow