CVE-2026-90688: Tenda w20e

Medium severity, CVSS 6.5. EPSS: 0.7% chance of exploitation in the next 30 days.

A vulnerability was identified in Tenda W20E 15.11.0.61068_1546_841_CN_TDC. This issue affects the function formIPMacBindAdd of the component HTTP Handler. Such manipulation of the argument IPMacBindRule leads to stack-based buffer overflow. It is possible to launch the attack remotely.

Affected products

• Tenda w20e: version 15.11.0.61068_1546_841_CN_TDC only

Published 2026-09-14. Last modified 2026-09-15.