CVE-2022-40855

Name of the Vulnerable Software and Affected Versions Tenda W20E router version 15.11.0.6

Description The issue is related to a stack overflow in the formSetPortMapping function, which can be triggered by a POST request to the "goform/setPortMapping/" endpoint. This allows attackers to potentially cause a Denial of Service (DoS) or achieve Remote Code Execution (RCE) by manipulating the portMappingServer, portMappingProtocol, portMappingWan, portMappingInternal, and portMappingExternal parameters.

Recommendations For Tenda W20E router version 15.11.0.6, consider disabling the formSetPortMapping function or restricting access to the "goform/setPortMapping/" endpoint until a patch is available. Additionally, avoid using the portMappingServer, portMappingProtocol, portMappingWan, portMappingInternal, and portMappingExternal parameters in the affected endpoint to minimize the risk of exploitation.