CVE-2026-11523

A flaw has been found in Tenda W20E 15.11.0.6. This issue affects the function formPortalAuth of the file /goform/PortalAuth of the component Web Management Interface. Executing a manipulation of the argument gotoUrl can lead to stack-based buffer overflow. The attack can be launched remotely. The exploit has been published and may be used.

• CWE-119
• CWE-121

• https://github.com/Robots10/IoT_vlu/blob/main/reports/Tenda/formPortalAuth/formPortalAuth.md
• https://vuldb.com/cve/CVE-2026-11523
• https://vuldb.com/submit/836471
• https://vuldb.com/vuln/369143
• https://vuldb.com/vuln/369143/cti
• https://www.tenda.com.cn/
• https://github.com/Robots10/IoT_vlu/blob/main/reports/Tenda/formPortalAuth/formPortalAuth.md

Published

Jun 8, 2026

Last Modified

Jul 23, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-11518A vulnerability was identified in SourceCodester Inventory S…4.3
• CVE-2026-11519A security flaw has been discovered in SourceCodester Invent…6.3
• CVE-2026-1152A security vulnerability has been detected in technical-laoh…9.8
• CVE-2026-11520A weakness has been identified in SourceCodester Inventory S…3.5
• CVE-2026-11521A security vulnerability has been detected in Mohammed-eid35…6.3
• CVE-2026-11522A vulnerability was detected in Tenda W20E 15.11.0.6. This v…8.8
• CVE-2026-11524A vulnerability has been found in Tenda W20E 15.11.0.6. Impa…8.8
• CVE-2026-11525Impact: When undici parses a Set-Cookie header, it accepts a…3.7
• CVE-2026-11526GD versions before 2.86 for Perl allow OS command injection …9.8
• CVE-2026-11527Config::IniFiles versions before 3.001000 for Perl allow OS …8.6
• CVE-2026-11528A vulnerability was found in Tenda AC18 15.03.05.05. The aff…8.8
• CVE-2026-11529A vulnerability was determined in designcomputer mysql-mcp-s…6.3