CVE-2026-90689

A remotely exploitable stack-based buffer overflow (CWE-121) exists in the formDelWebAuthWhiteUser function of the Tenda W20E router's web management interface, affecting firmware version 15.11.0.61068_1546_841_CN_TDC. An attacker triggers the flaw by sending a crafted request in which the webAuthWhiteUserIndex argument is manipulated to exceed the bounds of a stack buffer; the CVSS 4.0 vector indicates low privileges are required (PR:L), suggesting an authenticated or low-privilege session with the management interface is sufficient. Successful exploitation can crash the device and, given the high confidentiality, integrity, and availability impact ratings (VC:H/VI:H/VA:H), plausibly lead to arbitrary code execution on the router, with a base score of 8.7 (high). Devices affected are Tenda W20E routers—primarily a China-market enterprise/SMB access router—running the listed firmware. There is no evidence of in-the-wild exploitation: the CVE is not in the CISA KEV catalog and no public proof of concept is known.

What to do: Disable WAN-side (remote) access to the router's web management interface and restrict administration to the LAN or a VPN, since exploitation requires only low privileges against the interface. Monitor vendor advisories and apply updated Tenda firmware for the W20E as soon as a fixed version is released—no patched version is identified in current data. Review device logs and uptime for unexpected crashes or suspicious requests targeting formDelWebAuthWhiteUser, and reboot plus credential rotation if compromise is suspected.