CVE-2022-40866

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Tenda W20E router V15.11.0.6 (US_W20EV4.0br_V15.11.0.6(1068_1546_841)_CN_TDC) contains a stack overflow vulnerability in the function formSetDebugCfg with request /goform/setDebugCfg/

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-787

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/CPSeek/Router-vuls/blob/main/Tenda/W20E/setDebugCfg.mdExploit, Third Party Advisory
https://github.com/CPSeek/Router-vuls/blob/main/Tenda/W20E/setDebugCfg.mdExploit, Third Party Advisory

Timeline

Published: Sep 23, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-408679.8Tenda W20E router V15.11.0.6 (US_W20EV4.0br_V15.11.0.6(1068_1546_841)_CN_TDC) contains a stack overflow vulnerability in the function formIP CVE-2022-408689.8Tenda W20E router V15.11.0.6 (US_W20EV4.0br_V15.11.0.6(1068_1546_841)_CN_TDC) contains a stack overflow vulnerability in the function formDe CVE-2022-408699.8Tenda AC15 and AC18 routers V15.03.05.19 contain stack overflow vulnerabilities in the function fromDhcpListClient with a combined parameter CVE-2022-40874.3A vulnerability was found in iPXE. It has been declared as problematic. This vulnerability affects the function tls_new_ciphertext of the fi CVE-2022-408708.1The Web Client of Parallels Remote Application Server v18.0 is vulnerable to Host Header Injection attacks. This vulnerability allows attack CVE-2022-408719.8Dolibarr ERP & CRM <=15.0.3 is vulnerable to Eval injection. By default, any administrator can be added to the installation page of dolibarr CVE-2022-408729.8An SQL injection vulnerability issue was discovered in Sourcecodester Simple E-Learning System 1.0., in /vcs/classRoom.php?classCode=, class CVE-2022-408747.5Tenda AX1803 v1.0.0.1 was discovered to contain a heap overflow vulnerability in the GetParentControlInfo function, which can cause a denial CVE-2022-408757.5Tenda AX1803 v1.0.0.1 was discovered to contain a heap overflow in the function GetParentControlInfo.CVE-2022-408769.8In Tenda ax1803 v1.0.0.1, the http requests handled by the fromAdvSetMacMtuWan functions, wanSpeed, cloneType, mac, can cause a stack overfl CVE-2022-408779.8Exam Reviewer Management System 1.0 is vulnerable to SQL Injection via the ‘id’ parameter.CVE-2022-408788.8In Exam Reviewer Management System 1.0, an authenticated attacker can upload a web-shell php file in profile page to achieve Remote Code Exe