Command Injection Vulnerability in Tenda W20E Router
CVE-2025-44866

Currently unrated

Key Information:

Vendor

Tenda
Status
W20E Router
Vendor
CVE Published:
1 May 2025

What is CVE-2025-44866?

The Tenda W20E Router, specifically version V15.11.0.6, has a command injection vulnerability stemming from inadequate validation within the formSetDebugCfg function. This flaw exploits the level parameter, enabling malicious actors to craft and send requests that execute arbitrary commands on the device. Such vulnerabilities can lead to unauthorized access and potential takeover of networked systems unless properly mitigated.

References

https://github.com/Summermu/VulnForIoT/tree/main/Tenda_W2...

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.