Tenda W20E CVE-2026-90688

Exploitation requires valid credentials to the Tenda W20E HTTP management interface (PR:L per CVSS - at minimum a low-privilege account), network access to the management port (typically TCP 80/443), and the specific firmware version 15.11.0.61068_1546_841_CN_TDC or potentially related builds. The formIPMacBindAdd function must be reachable, which requires the IP-MAC binding feature to be accessible in the router's web UI (enabled by default on this device class). Exploitation is limited by: (1) the authentication requirement - unauthenticated exploitation is not indicated by the CVSS PR:L metric; (2) default credential reuse or credential theft being a prerequisite; (3) network-level access to the management interface, which should not be exposed to the WAN in a correctly configured deployment. No special browser, OS, or client-side interaction is required.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VA:H) describes a network-reachable, low-complexity, low-privilege attack with confirmed high availability impact and no reported confidentiality or integrity loss. EPSS data is absent from the input, so exploitation probability cannot be quantified precisely; however, the existence of a public GitHub advisory from a dedicated router vulnerability researcher substantially raises the likelihood of working exploit code being available. The device is not listed in CISA KEV, and no public exploit has been formally confirmed, but the advisory repository pattern (Amalll-Sec/router-vulnerability-research) is consistent with POC disclosure. A key uncertainty is whether the stack overflow is exploitable for code execution beyond DoS: CWE-121 in embedded router firmware has historically enabled RCE, but the CVSS vector records only VA:H with C:N/I:N, suggesting the reporter assessed only a reliable crash. Even a mid-sized municipal IT team in koszalin deploying these routers for branch office connectivity should treat this as urgent patching given the low attack complexity and authenticated-but-low-privilege barrier. The PR:L requirement means the attacker needs credentials to the router's web management interface, which limits unauthenticated mass exploitation but is a weak gate in environments with default credentials.

An attacker with valid (possibly default) credentials to the Tenda W20E web management interface sends a crafted HTTP POST request to the formIPMacBindAdd endpoint with an excessively long IPMacBindRule parameter value. The oversized input overflows the fixed stack buffer in the handler function, corrupting the stack and causing the router daemon to crash, resulting in device unavailability or reboot. A public advisory from Amalll-Sec suggests the vulnerability has been reproduced, making exploit code likely accessible to motivated threat actors.