What’s Vulnerable › Vulnerabilities

CVE-2022-40855

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 14.1% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2022-09-23 · updated 2026-06-17
• Weakness: CWE-787

Description

Tenda W20E router V15.11.0.6 contains a stack overflow in the function formSetPortMapping with post request 'goform/setPortMapping/'. This vulnerability allows attackers to cause a Denial of Service (DoS) or Remote Code Execution (RCE) via the portMappingServer, portMappingProtocol, portMappingWan, porMappingtInternal, and portMappingExternal parameters.

Affected products

• Tenda W20E: 15.11.0.6

References

• https://github.com/CPSeek/Router-vuls/blob/main/Tenda/W20E/formSetPortMapping.md
• https://github.com/CPSeek/Router-vuls/blob/main/Tenda/W20E/formSetPortMapping.md

Get alerted when CVE-2022-40855 or the next vulnerability affects your stack