A buffer overflow occurs in the Tenda W20E firmware when an attacker controls the value of the variable nptr. The value is passed to the getMibPrefix function and concatenated using sprintf without proper length checks, which can overwrite adjacent memory and give the attacker the ability to execute arbitrary code on the device.

The vulnerability exists in Tenda W20E model V4.0br firmware version 15.11.0.6. No other vendors or product versions are affected according to the current data.

The CVSS score of 9.8 marks this flaw as critical, and an EPSS score of less than 1% indicates a low probability of exploitation but not zero. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The attack vector is likely remote, as the attacker can influence the nptr value through network interactions with the router’s management interface; however, this is inferred from the described behavior and not explicitly stated in the advisory.