CVE-2026-19822 is a stack-based buffer overflow vulnerability affecting the Tenda W20E router firmware 15.11.0.6(1068_1546_841)_CN_TDC. The issue arises from improper validation of the qosListConnecttedNum parameter in the lstAdd function within the QoS Edit component's /goform/editQos file. This flaw allows remote attackers to cause a buffer overflow on the stack, potentially leading to arbitrary code execution or denial of service. The vulnerability requires no user interaction and has a CVSS 4.0 base score of 8.7, indicating high severity. Exploit code is publicly available, but no vendor patch or official fix has been disclosed.

Successful exploitation of this vulnerability can result in a stack-based buffer overflow, which may allow remote attackers to execute arbitrary code or cause a denial of service on the affected device. The vulnerability is remotely exploitable without authentication or user interaction, increasing its risk. However, there are no confirmed reports of exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch has been provided by Tenda as of the publication date, users should monitor vendor communications for updates. In the meantime, restricting remote access to the device's management interface and disabling unnecessary services may reduce exposure.