This vulnerability affects Tenda W20E version 15.11.0.6 in the Web Management Interface component, specifically the formPortalAuth function accessed via /goform/PortalAuth. By sending a specially crafted request manipulating the gotoUrl parameter, an attacker can trigger a stack-based buffer overflow. The vulnerability is remotely exploitable without user interaction and requires low attack complexity and privileges. The CVSS 4.0 base score is 8.7, reflecting high impact on confidentiality, integrity, and availability. No official patch or vendor advisory has been published to date.

Successful exploitation of this vulnerability can lead to memory corruption on the device, potentially allowing an attacker to execute arbitrary code or cause a denial of service. The vulnerability impacts confidentiality, integrity, and availability of the affected device. Since the exploit is remotely executable and requires no user interaction, the risk to exposed devices is significant. However, there is no evidence of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the Web Management Interface to trusted networks only and monitor for unusual activity. Avoid exposing the device management interface directly to untrusted networks. Follow vendor communications closely for updates on patches or official mitigations.