CVE-2026-24111
Published: 02 March 2026
Summary
CVE-2026-24111 is a critical-severity Classic Buffer Overflow (CWE-120) vulnerability in Tenda W20E Firmware. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 46.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Deeper analysis
CVE-2026-24111 is a buffer overflow vulnerability affecting the Tenda W20E router running firmware version V4.0br_V15.11.0.6. The issue arises when attackers specify a crafted value for the `userInfo` parameter, which is passed to the `addAuthUser` function and processed by `sscanf` without proper size validation. This leads to a buffer overflow condition, classified under CWE-120 (Buffer Copy without Checking Size of Input).
The vulnerability has a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating it is exploitable remotely over the network with low complexity, requiring no authentication privileges or user interaction. Attackers can achieve high impacts on confidentiality, integrity, and availability, potentially enabling arbitrary code execution or denial of service on the affected device.
Advisories and additional details are available in references including a GitHub repository at https://github.com/akuma-QAQ/CVEreport/tree/main/D-link/CVE-2026-24111 (listed twice) and the official Tenda notice at https://www.tenda.com.cn/material/show/2707.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-9183
Vulnerability details
An issue was discovered in Tenda W20E V4.0br_V15.11.0.6. Attackers may exploit the vulnerability by specifying the value of `userInfo`. When `userInfo` is passed into the `addAuthUser` function and processed by `sscanf` without size validation, it could lead to buffer overflow.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Remote unauthenticated buffer overflow in public-facing router web function (addAuthUser) directly enables T1190 for initial access and RCE/DoS.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validating the size and format of inputs like userInfo to prevent buffer overflows from unvalidated sscanf processing.
Enforces restrictions on the quantity of input data, such as limiting userInfo size to avert buffer overflow conditions.
Provides runtime memory protections like stack canaries and non-executable regions to block exploitation of buffer overflows for code execution.