CVE-2026-24114
Published: 02 March 2026
Summary
CVE-2026-24114 is a critical-severity Classic Buffer Overflow (CWE-120) vulnerability in Tenda W20E Firmware. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 45.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Deeper analysis
CVE-2026-24114 is a buffer overflow vulnerability in the Tenda W20E router running firmware version V4.0br_V15.11.0.6. The issue stems from a failure to validate the `pPortMapIndex` parameter, which can lead to buffer overflows during the use of the `strcpy` function. Classified under CWE-120 (Buffer Copy without Checking Size of Input), it has a CVSS v3.1 base score of 9.8, indicating critical severity due to its network accessibility, low attack complexity, lack of required privileges or user interaction, and high impacts on confidentiality, integrity, and availability.
The vulnerability can be exploited remotely by unauthenticated attackers over the network with no privileges or user interaction required. Successful exploitation allows attackers to trigger buffer overflows, potentially resulting in arbitrary code execution, denial of service, or unauthorized access to sensitive data and system control on the affected device.
Mitigation details are available in vendor resources, including the Tenda advisory at https://www.tenda.com.cn/material/show/2707. Additional technical reporting is provided in the GitHub repository at https://github.com/akuma-QAQ/CVEreport/tree/main/D-link/CVE-2026-24114. Security practitioners should check these for firmware updates or workarounds specific to the Tenda W20E.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-9186
Vulnerability details
An issue was discovered in Tenda W20E V4.0br_V15.11.0.6. Failure to validate `pPortMapIndex` may lead to buffer overflows when using `strcpy`.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Buffer overflow in network-accessible router firmware (web/management interface) directly enables remote unauthenticated exploitation of a public-facing application, leading to RCE/DoS.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates CVE-2026-24114 by requiring identification, reporting, and timely patching of the buffer overflow flaw in the Tenda W20E firmware.
Enforces validation of inputs like pPortMapIndex to prevent buffer overflows from unvalidated parameters passed to strcpy.
Implements memory safeguards such as non-executable stacks and address space randomization to block arbitrary code execution from the buffer overflow.