CVE-2026-24113

{"dataType": "CVE_RECORD", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2026-24113", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "dateUpdated": "2026-03-05T15:54:30.496Z", "dateReserved": "2026-01-21T00:00:00.000Z", "datePublished": "2026-03-02T00:00:00.000Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-03-02T14:43:20.367Z"}, "descriptions": [{"lang": "en", "value": "An issue was discovered in Tenda W20E V4.0br_V15.11.0.6. Attackers may exploit the vulnerability by controlling the value of `nptr`. When this value is passed into the `getMibPrefix` function and concatenated using `sprintf` without proper size validation, it could lead to a buffer overflow vulnerability."}], "affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"version": "n/a", "status": "affected"}]}], "references": [{"url": "https://www.tenda.com.cn/material/show/2707"}, {"url": "https://github.com/akuma-QAQ/CVEreport/tree/main/D-link/CVE-2026-24113"}], "problemTypes": [{"descriptions": [{"type": "text", "lang": "en", "description": "n/a"}]}]}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-120", "lang": "en", "description": "CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')"}]}], "references": [{"url": "https://github.com/akuma-QAQ/CVEreport/tree/main/D-link/CVE-2026-24113", "tags": ["exploit"]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-03-05T15:54:02.160215Z", "id": "CVE-2026-24113", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-05T15:54:30.496Z"}}]}, "dataVersion": "5.2"}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-24113", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-03-05T15:54:02.160215Z"}}}], "references": [{"url": "https://github.com/akuma-QAQ/CVEreport/tree/main/D-link/CVE-2026-24113", "tags": ["exploit"]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-120", "description": "CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-05T15:54:25.658Z"}}], "cna": {"affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "references": [{"url": "https://www.tenda.com.cn/material/show/2707"}, {"url": "https://github.com/akuma-QAQ/CVEreport/tree/main/D-link/CVE-2026-24113"}], "descriptions": [{"lang": "en", "value": "An issue was discovered in Tenda W20E V4.0br_V15.11.0.6. Attackers may exploit the vulnerability by controlling the value of `nptr`. When this value is passed into the `getMibPrefix` function and concatenated using `sprintf` without proper size validation, it could lead to a buffer overflow vulnerability."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "text", "description": "n/a"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-03-02T14:43:20.367Z"}}}, "cveMetadata": {"cveId": "CVE-2026-24113", "state": "PUBLISHED", "dateUpdated": "2026-03-05T15:54:30.496Z", "dateReserved": "2026-01-21T00:00:00.000Z", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "datePublished": "2026-03-02T00:00:00.000Z", "assignerShortName": "mitre"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "source": "cve@mitre.org"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:tenda:w20e_firmware:15.11.0.6:*:*:*:*:*:*:*", "matchCriteriaId": "31C1283D-8DCF-49C0-92FF-34CF842D00BF", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:tenda:w20e:4.0:*:*:*:*:*:*:*", "matchCriteriaId": "A09E3911-CF3F-4C15-8EF9-5AA8EEA0FC21", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "An issue was discovered in Tenda W20E V4.0br_V15.11.0.6. Attackers may exploit the vulnerability by controlling the value of `nptr`. When this value is passed into the `getMibPrefix` function and concatenated using `sprintf` without proper size validation, it could lead to a buffer overflow vulnerability."}, {"lang": "es", "value": "Se descubri\u00f3 un problema en Tenda W20E V4.0br_V15.11.0.6. Los atacantes pueden explotar la vulnerabilidad al controlar el valor de 'nptr'. Cuando este valor se pasa a la funci\u00f3n 'getMibPrefix' y se concatena usando 'sprintf' sin una validaci\u00f3n de tama\u00f1o adecuada, podr\u00eda conducir a una vulnerabilidad de desbordamiento de b\u00fafer."}], "id": "CVE-2026-24113", "lastModified": "2026-06-17T10:22:38.897", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-24113", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-03-05T15:54:02.160215Z", "version": "2.0.3"}}]}, "published": "2026-03-02T15:16:33.657", "references": [{"source": "cve@mitre.org", "tags": ["Exploit", "Third Party Advisory"], "url": "https://github.com/akuma-QAQ/CVEreport/tree/main/D-link/CVE-2026-24113"}, {"source": "cve@mitre.org", "tags": ["Product"], "url": "https://www.tenda.com.cn/material/show/2707"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Exploit", "Third Party Advisory"], "url": "https://github.com/akuma-QAQ/CVEreport/tree/main/D-link/CVE-2026-24113"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-120"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-120"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[15.11.0.6,15.11.0.6]"}}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "n/a", "source": "cna", "vendor": "n/a"}, "product": "w20e", "vendor": "tenda"}], "analysis": {"en": {"generated_at": "2026-04-16T14:53:25.098963+00:00", "value": {"mitigation_remediation": ["Obtain and install the most recent firmware release from Tenda that addresses this buffer overflow.", "Disable any unnecessary remote management functions, such as the WAN\u2011side web interface or SSH, to reduce the attack surface.", "If an updated firmware is unavailable, block external access to the device\u2019s management ports and isolate it from critical network segments."], "summary": {"action": "Update Firmware", "impact": "Buffer Overflow (CWE-120)"}, "threat_synthesis": {"affected_systems": "The affected product is the Tenda W20E model running firmware version 4.0br_V15.11.0.6. No other vendors or revisions are listed. The CPE identifiers point to the hardware and firmware versions described above.", "description_and_impact": "An input validation flaw permits attackers to control the nptr parameter, which is passed to getMibPrefix and concatenated via sprintf without size checks, leading to a classic buffer overflow in Tenda W20E firmware. This flaw allows the attacker to overflow the stack, potentially executing arbitrary code or causing a denial of service. The vulnerability is rooted in improper bounds checking (CWE-120).", "risk_and_exploitability": "The CVSS score of 9.8 indicates critical severity, while the EPSS score of less than 1% signals a low probability of current exploitation. It is not listed in CISA's KEV catalog, yet the high base score warrants proactive remediation. Attackers can likely exploit the flaw over the network by sending crafted packets or HTTP requests that trigger the vulnerable getMibPrefix call, provided the device is reachable and remote management is enabled (based on the description, this is inferred)."}}}}, "created": "2026-03-03T08:46:38.090690+00:00", "title": "Buffer Overflow in Tenda W20E Firmware Allows Remote Exploitation", "updated": "2026-04-16T15:00:14.324105+00:00", "vendors": ["tenda", "tenda$PRODUCT$w20e"]}