CVE-2026-24113 is a critical buffer overflow (CVSS 9.8) in the Tenda W20E router, firmware V4.0br_V15.11.0.6. The nptr value is concatenated by getMibPrefix with sprintf and no size check. The record lists no fixed version and the vendor page I checked did not state one. Restrict the admin interface and look for newer firmware.
What's affected
Tenda W20E, firmware V4.0br_V15.11.0.6, according to the record. The affected input is nptr, handled by the getMibPrefix function, which concatenates it with sprintf. The record gives no fixed version. The Tenda download page it links to showed no advisory text I could read, so check Tenda's support site for newer W20E firmware.
This is one of a set of similar reports against the same firmware: CVE-2026-24109, CVE-2026-24111, CVE-2026-24112, CVE-2026-24114, CVE-2026-24115. They sit in different functions, so they may be fixed together or separately. Confirm each one in the vendor release notes.
How to check if you're exposed
Log in to the router's admin page and read the firmware version. If it is V15.11.0.6, assume you are affected. Then check whether the web admin interface or remote management is reachable from the internet or from guest networks. The vector in the record is network reachable with no login needed, so reachability decides your risk.
What to do now
- Check Tenda's support and download pages for W20E firmware newer than V15.11.0.6, and read the notes for these CVEs. Do not assume a fix exists.
- Turn off remote management on the WAN side, and allow admin access only from a trusted wired network.
- Put the router behind another firewall layer if it is used in an office, and keep untrusted devices on a separate network.
- If no fix appears, plan to replace the device, especially if it fronts anything important.
- Watch the router for crashes or unexpected reboots, which can be a sign of memory corruption attempts.
Why it matters
The weakness is CWE-120, a classic buffer overflow: data is copied into a fixed size buffer without checking the length. Functions such as sprintf, strcpy and sscanf with unbounded format specifiers are the standard source. The fix is bounded copies and length checks.
Router firmware is often updated rarely, and consumer and small business devices may not get a fix quickly. A memory corruption bug in a network device with no login needed is a serious risk because it sits at the edge. The record does not list this CVE as known exploited, and I will not describe exploitation details that the record does not give.
Reading the severity score
The record gives a CVSS base score of 9.8, published 2026-03-02. In the vector, the attacker works over the network, needs no account, and the attack is low in complexity. User interaction is not needed. Impact on confidentiality is high, on integrity high and on availability high.
A base score describes the flaw in general, not your risk. Weigh it against how exposed your instance is and what it can reach. The Gold page for the CVE keeps the score, weakness and references together.
Quick check
Is there a patch?
The record lists none. Check the vendor's firmware page and release notes, and treat any claim of a fix as unconfirmed until you see it there.
Sources
Last reviewed: 19 October 2026.
