CVE-2026-19822
Deferred Deferred - Pending Action

Stack-Based Buffer Overflow in Tenda W20E QoS Edit

Publication date: 2026-08-14

Last updated on: 2026-08-14

Assigner: VulDB

Description
A vulnerability was identified in Tenda W20E 15.11.0.6(1068_1546_841)_CN_TDC. This issue affects the function lstAdd of the file /goform/editQos of the component QoS Edit. Such manipulation of the argument qosListConnecttedNum leads to stack-based buffer overflow. The attack may be launched remotely. The exploit is publicly available and might be used.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-14
Last Modified
2026-08-14
Generated
2026-09-03
AI Q&A
2026-08-14
EPSS Evaluated
2026-09-02
NVD
CVE-2026-19822
EUVD
EUVD-2026-58624

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
tenda w20e 15.11.0.6
tenda w20e 4.0br_v15.11.0.6
tenda w20e to 15.11.0.6 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-119 The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
CWE-121 A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a stack-based buffer overflow vulnerability in the Tenda W20E router firmware. It occurs in the lstAdd function of the /goform/editQos component when processing the qosListConnecttedNum parameter. The issue arises because the code uses sprintf to copy user-controlled input into a fixed-size buffer without proper length checks, allowing attackers to overflow the stack.

Detection Guidance

To detect this vulnerability, monitor network traffic for unusually long values in the qosListConnecttedNum parameter sent to the /goform/editQos endpoint on Tenda W20E devices. Use packet inspection tools like Wireshark to filter HTTP POST requests to this path and check for payloads exceeding typical lengths.

Impact Analysis

An attacker could exploit this to execute arbitrary code remotely or cause a denial of service. This might allow unauthorized access to the router, network traffic interception, or disruption of network services. The exploit is publicly available, increasing the risk of attacks.

Compliance Impact

This vulnerability could potentially lead to unauthorized access or control of the affected Tenda W20E device due to stack-based buffer overflow. For GDPR, this may impact data confidentiality and integrity if the device processes personal data. For HIPAA, it could compromise protected health information if the device is used in healthcare environments. The lack of proper input validation and potential for remote code execution increases the risk of data breaches.

Mitigation Strategies

Immediately update the Tenda W20E firmware to the latest patched version if available. If no patch exists, restrict access to the device's web interface from untrusted networks and disable remote administration. Monitor for suspicious activity and consider isolating the device until a fix is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-19822. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart