CVE-2026-11523: Tenda W20E Web Management PortalAuth formPortalAuth stack-based overflow

Synopsis

A stack-based buffer overflow affects the Tenda W20E router (firmware 15.11.0.6) in the formPortalAuth function of its web management portal, reachable over the network by any authenticated user with a low-privilege account. An attacker who manipulates the gotoUrl argument can overflow the stack buffer, enabling full remote code execution on the device. No vendor patch exists yet; HarborGuard is tracking the advisory for patch availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable formPortalAuth endpoint is exposed over the network, meaning an attacker must be able to reach the web management interface of the device remotely.

• AuthenticationRequired

  The CVSS vector specifies PR:L, so the attacker must hold a low-privilege account on the device before launching the overflow.

• Victim interactionNot required

  No victim interaction is needed; the attacker sends a crafted request directly to the endpoint without any user participation.

• Attack complexityDetail

  Attack complexity is low (AC:L), meaning the exploit is reliable and requires no special conditions, race timing, or environmental prerequisites to trigger the overflow.

Blast Radius

• Reads sensitive data accessible to the device process, including credentials, session tokens, and configuration values stored in memory.
• Overwrites stack memory to redirect execution, giving the attacker arbitrary code execution on the router.
• Modifies device configuration or routing state, enabling persistent access or traffic interception on the local network segment the device serves.
• Crashes the web management process or the broader device firmware, disrupting network services for all users connected through the device.