# CVE-2026-90689: Tenda W20E stack buffer overflow in formDelWebAuthWhiteUser

Source: https://junglewise.ai/threats/cve-2026-90689-tenda-w20e-stack-buffer-overflow-in-formdelwebauthwhiteuser  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-14. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-90689 · Severity: high · CVSS 8.8 · Published 2026-09-14

Tenda W20E is a wireless router used to provide internet connectivity in homes and small offices. A flaw in the web management interface allows an attacker to send specially crafted network requests that overflow memory buffers, causing the router's management process to crash and potentially enabling remote code execution. This could render the device unavailable and allow an attacker to take control of the router.

Technologies: [Tenda W20E](https://junglewise.ai/threats/technologies/w20e). Vendors: [Tenda](https://junglewise.ai/threats/vendors/tenda).

## Quick answers

**Is CVE-2026-90689 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-90689 being exploited in the wild.

**How severe is CVE-2026-90689?** High severity, with a CVSS score of 8.8, published 14 September 2026.

**Which products and versions are affected?** Tenda W20E 15.11.0.61068_1546_841_CN_TDC.

**Is there a fix for CVE-2026-90689?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-90689 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-90689?** Check whether you run Tenda W20E at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a stack-based buffer overflow (CWE-121) in the formDelWebAuthWhiteUser function of the Tenda W20E web interface. The vulnerable component uses unbounded strncpy operations to copy attacker-controlled values from the webAuthWhiteUserIndex parameter into 32-byte stack buffers without proper length validation. An attacker can send a specially crafted HTTP request with an oversized webAuthWhiteUserIndex argument to trigger memory corruption. The attack is remotely exploitable over the network without requiring authentication. Exploitation results in denial of service (crash of the web management process) and potentially arbitrary code execution on the device.

## Affected products

- Tenda W20E 15.11.0.61068_1546_841_CN_TDC

## Timeline

- 2026-09-14: disclosed

## References

- [https://github.com/Amalll-Sec/router-vulnerability-research/blob/main/advisories/Tenda/W20E/formDelWebAuthWhiteUser/README.md](https://github.com/Amalll-Sec/router-vulnerability-research/blob/main/advisories/Tenda/W20E/formDelWebAuthWhiteUser/README.md)
- [https://vuldb.com/cve/CVE-2026-90689](https://vuldb.com/cve/CVE-2026-90689)

## Related threats

- [Tenda W20E stack buffer overflow in formIPMacBindAdd](https://junglewise.ai/threats/cve-2026-90688-tenda-w20e-stack-buffer-overflow-in-formipmacbindadd)
- [Tenda W20E buffer overflow in formAddWebAuthUser](https://junglewise.ai/threats/cve-2026-36823-tenda-w20e-buffer-overflow-in-formaddwebauthuser)
- [Tenda W20E buffer overflow in formDelStaState](https://junglewise.ai/threats/cve-2026-36822-tenda-w20e-buffer-overflow-in-formdelstastate)
- [Tenda W20E buffer overflow in formCropAndSetWewifiPic](https://junglewise.ai/threats/cve-2026-36821-tenda-w20e-buffer-overflow-in-formcropandsetwewifipic)
- [Tenda W20E buffer overflow in formAddWebAuthWhiteUser](https://junglewise.ai/threats/cve-2026-36820-tenda-w20e-buffer-overflow-in-formaddwebauthwhiteuser)