CVE-2026-90688

Tenda W20E routers running firmware 15.11.0.61068_1546_841_CN_TDC contain a stack-based buffer overflow in the formIPMacBindAdd function of the HTTP handler, reachable remotely over the network. The flaw is triggered by supplying an oversized or malformed IPMacBindRule argument to the IP/MAC address-binding feature, which overflows a fixed-length stack buffer. With a CVSS 4.0 score of 7.1 (AV:N/AC:L/PR:L/VA:H), the scored impact is availability — crashing or rebooting the device — though stack overflows of this class can potentially be escalated to code execution depending on the target's memory protections. The PR:L rating means the attacker needs some level of authentication (valid low-privilege credentials or a companion auth-bypass flaw) to reach the vulnerable endpoint. No public proof-of-concept is known, and the CVE is not in CISA's KEV catalog, so there is no evidence of exploitation in the wild.

What to do: Restrict the router's web management interface to the internal LAN or a trusted management network and ensure it is not exposed to the internet. Check Tenda's support site for firmware newer than 15.11.0.61068_1546_841_CN_TDC and upgrade when a patch is released, noting Tenda has historically been slow to fix similar router flaws. Enforce strong, unique admin credentials since exploitation requires low privileges, and monitor the device for unexplained reboots or crashes that could indicate crash attempts.