ZeroDay Findings
Sign inSign up

Vulnerabilities

Vulnerability · CVE-2025-44866

Tenda W20E V15.11.0.6 was found to contain a command injection vulnerability in the formSetDebugCfg function via the level parameter.

Published May 1, 2025 · catalog updated May 1, 2025 · n/a n/a

Severity
Medium6.3
Known exploitation
Not in CISA/VulnCheck KEV
EPSS
1.2%
Remediation
Vendor / distro source
Affected products
vendor n/a n/a n/a

Tenda W20E V15.11.0.6 was found to contain a command injection vulnerability in the formSetDebugCfg function via the level parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request.

Technical analysis

Mechanism and impact are interpreted from ingested advisories — not independent exploit research.

  • CWE classification

    No CWE identifiers stored yet.

  • Prerequisites and impact

    Follow the original vendor advisory for access prerequisites and impact. This catalog does not invent exploit conditions.

How to fix CVE-2025-44866

What to do

Three reads of the same public record: the decision, the versions on file, and the signals. Confirm the vendor advisory before you patch. This page does not publish exploit steps.

Executive

This is a public record, not a confirmed incident. CVE-2025-44866 is a medium issue in n/a n/a (CVSS 6.3). CISA does not currently list it as known exploited. Next step: Compare installed versions with the linked vendor advisory before changing production.

System administrator

Check whether n/a n/a is installed. Ranges on record: n/a n/a n/a (n/a). Compare installed versions with the linked vendor advisory before changing production.

Security analyst

CVSS 6.3. EPSS 1.2%. CISA does not currently list it as known exploited. Weaknesses: not classified. Sources: epss, euvd. Exploit links, when listed below, point at the original publisher.

Related intelligence

  • Exploitation evidence

    Not listed as known exploited in CISA KEV. Not in CISA KEV or VulnCheck KEV.

  • Safe detection guidance

    Compare installed versions with the affected ranges below and verify the advisory from the original publisher. This site stores metadata and outbound links only; it does not ship exploit code or proof-of-concept payloads.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. May 1, 2025 · EUVD

    Detected

    Tenda W20E V15.11.0.6 was found to contain a command injection vulnerability in the formSetDebugCfg function via the level parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request.

  2. May 1, 2025 · EUVD

    Updated

    Tenda W20E V15.11.0.6 was found to contain a command injection vulnerability in the formSetDebugCfg function via the level parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request.

Affected versions

Enter an installed version to get a verified affected / not-affected result against the ranges below.

  • vendor n/a n/a n/an/a

Sources

  • FIRST EPSSExploitation probabilityCVE-2025-44866

    30-day exploitation probability 1.2%

    first.org
  • EUVDVulnerability recordEUVD-2025-13272

    Tenda W20E V15.11.0.6 was found to contain a command injection vulnerability in the formSetDebugCfg function via the level parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request.

    euvd.enisa.europa.eu

References

Freshness

Last verified in this catalog Oct 18, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.