CVE-2026-90688: Tenda W20E HTTP formIPMacBindAdd stack-based overflow
A vulnerability was identified in Tenda W20E 15.11.0.610681546841CNTDC. This issue affects the function formIPMacBindAdd of the component HTTP Handler. Such manipulation of the argument IPMacBindRule leads to stack-based buffer overflow. It is possible to launch the attack remotely.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Tenda W20E devices running firmware version 15.11.0.61068_1546_841_CN_TDC are identified as affected. The vulnerable functionality is in the device's HTTP handler.
What does an attacker need to exploit it?
An attacker can target the issue remotely and needs the ability to submit a crafted IPMacBindRule argument to the formIPMacBindAdd function. The provided severity vector indicates that low privileges are required and no user interaction is required.
What is the likely impact of successful exploitation?
Successful manipulation of the IPMacBindRule argument can trigger a stack-based buffer overflow. The supplied scoring indicates a high availability impact, with no assessed confidentiality or integrity impact.