Is CVE-2026-90689 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-90689 being exploited in the wild.

How severe is CVE-2026-90689?

High severity, with a CVSS score of 8.8, published 14 September 2026.

Which products and versions are affected?

Tenda W20E 15.11.0.61068_1546_841_CN_TDC.

Is there a fix for CVE-2026-90689?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-90689 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-90689?

Check whether you run Tenda W20E at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-90689: Tenda W20E stack buffer overflow in formDelWebAuthWhiteUser

CVE-2026-90689 · Severity: high · CVSS 8.8 · Published 2026-09-14

Tenda W20E is a wireless router used to provide internet connectivity in homes and small offices. A flaw in the web management interface allows an attacker to send specially crafted network requests that overflow memory buffers, causing the router's management process to crash and potentially enabling remote code execution. This could render the device unavailable and allow an attacker to take control of the router.

Technologies: Tenda W20E. Vendors: Tenda.

Quick answers

Is CVE-2026-90689 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-90689 being exploited in the wild.
How severe is CVE-2026-90689?: High severity, with a CVSS score of 8.8, published 14 September 2026.
Which products and versions are affected?: Tenda W20E 15.11.0.61068_1546_841_CN_TDC.
Is there a fix for CVE-2026-90689?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-90689 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-90689?: Check whether you run Tenda W20E at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a stack-based buffer overflow (CWE-121) in the formDelWebAuthWhiteUser function of the Tenda W20E web interface. The vulnerable component uses unbounded strncpy operations to copy attacker-controlled values from the webAuthWhiteUserIndex parameter into 32-byte stack buffers without proper length validation. An attacker can send a specially crafted HTTP request with an oversized webAuthWhiteUserIndex argument to trigger memory corruption. The attack is remotely exploitable over the network without requiring authentication. Exploitation results in denial of service (crash of the web management process) and potentially arbitrary code execution on the device.

Affected products

Tenda W20E 15.11.0.61068_1546_841_CN_TDC

Timeline

2026-09-14: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.