Description
An issue was discovered in Tenda W20E V4.0br_V15.11.0.6. Attackers may send overly long `addDhcpRules` data. When these rules enter the `addDhcpRule` function and are processed by `ret = sscanf(pRule, " %d\t%[^\t]\t%[^\n\r\t]", &dhcpsIndex, dhcpsIP, dhcpsMac);`, the lack of size validation for the rules could lead to buffer overflows in `dhcpsIndex`, `dhcpsIP`, and `dhcpsMac`.
Published: 2026-03-02
Score: 9.8 Critical
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution via buffer overflow in DHCP rule processing
Action: Immediate Patch
AI Analysis

Impact

The vulnerability resides in the addDhcpRules handler of Tenda W20E V4.0br_V15.11.0.6 firmware. An attacker can transmit data that exceeds the expected length, and because the sscanf call does not enforce bounds on dhcpsIndex, dhcpsIP and dhcpsMac, a buffer overflow occurs. This memory corruption can allow arbitrary code execution or a denial‑of‑service condition, consistent with CWE‑120.

Affected Systems

The flaw affects Tenda W20E routers running firmware version 4.0br_V15.11.0.6 (firmware build 15.11.0.6). Any device that exposes the addDhcpRules interface and is reachable from the network is subject to this issue.

Risk and Exploitability

With a CVSS score of 9.8 the vulnerability is rated critical. The EPSS score is below 1 %, indicating that, as of the data set, exploitation is unlikely. It is not currently listed in the CISA KEV catalog, so there are no documented exploits. The likely attack vector is remote, originating from the network interface that accepts DHCP rule submissions, potentially without authentication.

Generated by OpenCVE AI on April 16, 2026 at 14:44 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the router to the latest available firmware that contains the buffer‑overflow fix.
  • If an update is not available, block or disable the addDhcpRules API on the device or the network segment that contains management traffic.
  • As an interim safeguard, apply input size validation to the DHCP rule processing or segregate the management interface to trusted networks only.

Generated by OpenCVE AI on April 16, 2026 at 14:44 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 16 Apr 2026 15:00:00 +0000

Type Values Removed Values Added
Title Buffer Overflow via Overly Long addDhcpRules Input in Tenda W20E Firmware

Tue, 03 Mar 2026 16:00:00 +0000

Type Values Removed Values Added
First Time appeared Tenda
Tenda w20e
Tenda w20e Firmware
CPEs cpe:2.3:h:tenda:w20e:4.0:*:*:*:*:*:*:*
cpe:2.3:o:tenda:w20e_firmware:15.11.0.6:*:*:*:*:*:*:*
Vendors & Products Tenda
Tenda w20e
Tenda w20e Firmware

Mon, 02 Mar 2026 16:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-120
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Mon, 02 Mar 2026 15:45:00 +0000

Type Values Removed Values Added
Description An issue was discovered in Tenda W20E V4.0br_V15.11.0.6. Attackers may send overly long `addDhcpRules` data. When these rules enter the `addDhcpRule` function and are processed by `ret = sscanf(pRule, " %d\t%[^\t]\t%[^\n\r\t]", &dhcpsIndex, dhcpsIP, dhcpsMac);`, the lack of size validation for the rules could lead to buffer overflows in `dhcpsIndex`, `dhcpsIP`, and `dhcpsMac`.
References

Subscriptions

Tenda W20e W20e Firmware
cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published:

Updated: 2026-03-02T16:07:39.459Z

Reserved: 2026-01-21T00:00:00.000Z

Link: CVE-2026-24110

cve-icon Vulnrichment

Updated: 2026-03-02T16:07:08.101Z

cve-icon NVD

Status : Analyzed

Published: 2026-03-02T16:16:24.547

Modified: 2026-03-03T15:51:55.637

Link: CVE-2026-24110

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-16T14:45:25Z

Weaknesses