CVE-2026-24115 Details
Description
An issue was discovered in Tenda W20E V4.0br_V15.11.0.6. Failure to validate the sizes of `gstup` and `gstdwn` before concatenating them into `gstruleQos` may lead to buffer overflow.
A buffer overflow vulnerability has been identified in the Tenda W20E router, specifically in version V4.0br_V15.11.0.6. The issue arises in the 'goform/guestWifiRuleRefresh' component, where the sizes of the 'gstup' and 'gstdwn' parameters are not properly validated before being concatenated into 'gstruleQos'. This lack of validation can be exploited to cause a buffer overflow.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 3, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/akuma-QAQ/CVEreport/tree/main/D-link/CVE-2026-24115 | [email protected] | ExploitThird Party Advisory |
| https://www.tenda.com.cn/material/show/2707 | [email protected] | Product |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-120 | Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') | [email protected] |
| CWE-120 | Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| tenda w20e firmware | 15.11.0.6 |
CPE
Remediation
| |
| tenda w20e | 4.0 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 3, 2026 | CVE Modified | CISA-ADP |
| Mar 3, 2026 | Initial Analysis | [email protected] |
| Mar 2, 2026 | New CVE Received | [email protected] |