Command Injection Vulnerability in Tenda W20E Router
CVE-2025-44866

Currently unrated

Key Information:

Vendor

Tenda
Status
W20E Router
Vendor
CVE Published:
1 May 2025

What is CVE-2025-44866?

The Tenda W20E Router, specifically version V15.11.0.6, has a command injection vulnerability stemming from inadequate validation within the formSetDebugCfg function. This flaw exploits the level parameter, enabling malicious actors to craft and send requests that execute arbitrary commands on the device. Such vulnerabilities can lead to unauthorized access and potential takeover of networked systems unless properly mitigated.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

References

https://github.com/Summermu/VulnForIoT/tree/main/Tenda_W2...

EPSS Score

5% chance of being exploited in the next 30 days.

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.