CVE-2024-3874: high-severity vulnerability in Tenda W20E
Tenda W20E SetRemoteWebManage formSetRemoteWebManage stack-based overflow
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 8.8epss 1.3%
A vulnerability was found in Tenda W20E 15.11.0.6. It has been declared as critical. This vulnerability affects the function formSetRemoteWebManage of the file /goform/SetRemoteWebManage. The manipulation of the argument remoteIP leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-260908. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected products
Tenda · W20ERelated CVEs — Tenda W20E
In the same product, most dangerous first.
CVE-2026-90689HIGHTenda W20E formDelWebAuthWhiteUser stack-based overflowEPSS 0.9%CVE-2026-19824HIGHTenda W20E addIpMacBind ipMacBindListStore stack-based overflowEPSS 0.9%CVE-2026-19823HIGHTenda W20E QoS Rule Deletion delQos formQOSRuleDel stack-based overflowEPSS 0.9%CVE-2026-19822HIGHTenda W20E QoS Edit editQos lstAdd stack-based overflowEPSS 0.9%CVE-2026-90688HIGHTenda W20E HTTP formIPMacBindAdd stack-based overflowEPSS 0.7%CVE-2026-11524HIGHTenda W20E Web Management modifyWifiFilterRules stack-based overflowEPSS 0.5%