The vulnerability CVE-2026-90689 affects Tenda W20E firmware version 15.11.0.61068_1546_841_CN_TDC. It is a stack-based buffer overflow in the formDelWebAuthWhiteUser function. An attacker can remotely exploit this flaw by manipulating the webAuthWhiteUserIndex argument, causing a buffer overflow on the stack. The CVSS 4.0 base score is 8.7, indicating high severity, with network attack vector, low attack complexity, no user interaction, and high impact on confidentiality, integrity, and availability. No known exploits in the wild or patch information is provided.

Successful exploitation of this vulnerability can lead to stack-based buffer overflow, which may allow an attacker to execute arbitrary code or cause a denial of service on the affected device. The vulnerability can be triggered remotely without user interaction and requires low complexity, making it a significant risk for affected devices.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to the device management interface and monitor for unusual activity related to webAuthWhiteUserIndex manipulation.