CVE-2026-24110: Buffer Overflow
An issue was discovered in Tenda W20E V4.0brV15.11.0.6. Attackers may send overly long addDhcpRules data. When these rules enter the addDhcpRule function and are processed by ret = sscanf(pRule, " %d\t%[^\t]\t%[^\n\r\t]", &dhcpsIndex, dhcpsIP, dhcpsMac);, the lack of size validation for the rules could lead to buffer overflows in dhcpsIndex, dhcpsIP, and dhcpsMac.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-24110?
CVE-2026-24110 has a moderate severity rating due to the potential for denial of service attacks.
How do I fix CVE-2026-24110?
To fix CVE-2026-24110, update the Tenda W20E firmware to version 15.11.0.7 or later, which addresses the vulnerability.
What type of vulnerability is CVE-2026-24110?
CVE-2026-24110 is a buffer overflow vulnerability caused by improper input validation in the addDhcpRules function.
What products are affected by CVE-2026-24110?
CVE-2026-24110 specifically affects Tenda W20E devices running firmware version 15.11.0.6.
Can attackers exploit CVE-2026-24110 remotely?
Yes, attackers can remotely exploit CVE-2026-24110 by sending overly long data to the vulnerable addDhcpRules endpoint.