CVE-2026-24113

Опубликовано: 02 мар. 2026

Источник: nvd

CVSS3: 9.8

EPSS Низкий

Описание

An issue was discovered in Tenda W20E V4.0br_V15.11.0.6. Attackers may exploit the vulnerability by controlling the value of nptr. When this value is passed into the getMibPrefix function and concatenated using sprintf without proper size validation, it could lead to a buffer overflow vulnerability.

Ссылки

https://github.com/akuma-QAQ/CVEreport/tree/main/D-link/CVE-2026-24113
Exploit
Third Party Advisory
https://www.tenda.com.cn/material/show/2707
Product
https://github.com/akuma-QAQ/CVEreport/tree/main/D-link/CVE-2026-24113
Exploit
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одновременно

cpe:2.3:o:tenda:w20e_firmware:15.11.0.6:*:*:*:*:*:*:*

cpe:2.3:h:tenda:w20e:4.0:*:*:*:*:*:*:*

EPSS

Процентиль: 48%

0.00649

Низкий

9.8 Critical

CVSS3

Дефекты

CWE-120

Связанные уязвимости

GHSA-ccfh-jpm3-xpg5

CVSS3: 9.8

github

6 месяцев назад

An issue was discovered in Tenda W20E V4.0br_V15.11.0.6. Attackers may exploit the vulnerability by controlling the value of `nptr`. When this value is passed into the `getMibPrefix` function and concatenated using `sprintf` without proper size validation, it could lead to a buffer overflow vulnerability.

BDU:2026-02502

CVSS3: 9.8

fstec

6 месяцев назад

Уязвимость функции getMibPrefix (goform/formWifiFilterRulesModify) микропрограммного обеспечения маршрутизаторов Tenda W20E, позволяющая нарушителю выполнить произвольные команды

EPSS

Процентиль: 48%

0.00649

Низкий

9.8 Critical

CVSS3

Дефекты

CWE-120