The vulnerability identified as CVE-2026-19822 affects the Tenda W20E device running firmware version 15.11.0.6(1068_1546_841)_CN_TDC. It involves a stack-based buffer overflow in the lstAdd function within the /goform/editQos endpoint of the QoS Edit component. An attacker can remotely manipulate the qosListConnecttedNum argument to trigger this overflow. The vulnerability has a CVSS 3.1 base score of 8.8, indicating high impact on confidentiality, integrity, and availability. Although an exploit is publicly available, there is no information about active exploitation in the wild. No patch or official remediation has been provided or linked.

Successful exploitation of this vulnerability can lead to remote code execution or denial of service due to the stack-based buffer overflow. The CVSS vector indicates high impact on confidentiality, integrity, and availability. The vulnerability can be exploited remotely without user interaction but requires some level of privileges (PR:L).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided at this time. Until a patch is available, restrict remote access to the affected device and monitor for suspicious activity related to the /goform/editQos endpoint. Consider network-level controls to limit exposure.