CVE-2026-24111

Опубликовано: 02 мар. 2026

Источник: nvd

CVSS3: 9.8

EPSS Низкий

Описание

An issue was discovered in Tenda W20E V4.0br_V15.11.0.6. Attackers may exploit the vulnerability by specifying the value of userInfo. When userInfo is passed into the addAuthUser function and processed by sscanf without size validation, it could lead to buffer overflow.

Ссылки

https://github.com/akuma-QAQ/CVEreport/tree/main/D-link/CVE-2026-24111
Exploit
Third Party Advisory
https://www.tenda.com.cn/material/show/2707
Product
https://github.com/akuma-QAQ/CVEreport/tree/main/D-link/CVE-2026-24111
Exploit
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одновременно

cpe:2.3:o:tenda:w20e_firmware:15.11.0.6:*:*:*:*:*:*:*

cpe:2.3:h:tenda:w20e:4.0:*:*:*:*:*:*:*

EPSS

Процентиль: 48%

0.00649

Низкий

9.8 Critical

CVSS3

Дефекты

CWE-120

Связанные уязвимости

GHSA-h4gj-g96p-mj65

CVSS3: 9.8

github

6 месяцев назад

An issue was discovered in Tenda W20E V4.0br_V15.11.0.6. Attackers may exploit the vulnerability by specifying the value of `userInfo`. When `userInfo` is passed into the `addAuthUser` function and processed by `sscanf` without size validation, it could lead to buffer overflow.

BDU:2026-02501

CVSS3: 9.8

fstec

6 месяцев назад

Уязвимость функции addAuthUser (goform/formAddWebAuthUse) микропрограммного обеспечения маршрутизаторов Tenda W20E, позволяющая нарушителю выполнить произвольные команды

EPSS

Процентиль: 48%

0.00649

Низкий

9.8 Critical

CVSS3

Дефекты

CWE-120