CVE-2026-11523

Name of the Vulnerable Software and Affected Versions Tenda W20E version 15.11.0.6

Description A flaw in the Web Management Interface allows a remote attack via a stack-based buffer overflow. This occurs when the gotoUrl argument is manipulated within the formPortalAuth() function of the /goform/PortalAuth endpoint. A stack-based buffer overflow is a condition where a program writes more data to a buffer located on the stack than the buffer is allocated to hold, potentially overwriting adjacent memory.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. Restrict access to the /goform/PortalAuth endpoint to minimize the risk of exploitation.