A flaw in the Tenda W20E firmware allows the unvalidated value of the parameter usbPartitionName to be inserted directly into a system command. This oversight permits an attacker to execute arbitrary shell commands with the privileges of the router, potentially compromising device configuration and data confidentiality. The issue is catalogued as CWE‑94, representing command injection weaknesses.

The vulnerability is present in Tenda routers running the W20E model with firmware version V4.0br_V15.11.0.6. No other vendor or product information is enumerated.

The CVSS score of 9.8 indicates a critical impact, and the EPSS score of 1% signals that exploitation is unlikely but possible. The vulnerability is not listed in the CISA KEV catalog, suggesting it has not yet been widely exploited in the wild. Because the component in question is accessed via the USB interface, the most probable attack vector involves a local attacker or one with physical access to the device, who can supply a malicious usbPartitionName value. Such an attacker can run arbitrary commands, effectively gaining full control of the router’s operating system.