Tenda W20E firmware V4.0br_V15.11.0.6 contains a buffer overflow that can be triggered by specifying an overly long value for the parameter picName when it is passed to sprintf without length checks. If an attacker can control this input, the overflow can overwrite adjacent memory and allow execution of arbitrary code, compromising the integrity and confidentiality of the device and the network it supports.

The affected system is the Tenda W20E wireless router running firmware build 4.0br V15.11.0.6. Only that firmware version is known to contain the flaw.

The flaw is scored CVSS 9.8, placing it in the Critical severity range. The EPSS score is below 1 %, indicating a very low current exploitation probability, and the issue is not listed in the CISA KEV catalog. Although the official attack vector is not explicitly disclosed, it is inferred that an attacker needs to send a crafted request containing the picName parameter, suggesting a remote or network‑based exploitation scenario. The primary impact is the potential for arbitrary code execution on the affected router.