CVE-2026-19790
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk38th percentile - higher than 38% of all known CVEs
Summary
A vulnerability was identified in Tenda G0 up to 20260625. The function formSetPortMirror in /goform/module of the httpd Web Management Interface is affected. Manipulating the argument portMirrorMirroredPorts leads to stack-based buffer overflow. The attack can be executed remotely, and the exploit is publicly available.
Risk Assessment
Stack-based buffer overflow could allow remote code execution or device crash, potentially disrupting network operations.
Recommendation
Update Tenda G0 firmware to the latest patched version. Restrict management interface access and consider using a firewall.
Other vulnerabilities in Tenda G0
See all- CVE-2026-19792High
A security flaw has been discovered in Tenda G0 up to 20260625. The function setPortMapping in /goform/module of the httpd web management interface is affected. Manipulating the argument portMappingServer/porMappingtInternal/portMappingExternal results in buffer overflow. The attack can be carried out remotely, and the exploit is public.
- CVE-2026-19791High
A weakness has been identified in Tenda G0 up to 20260625. The function addStaticRoute in /goform/module of the httpd web management interface is affected. Manipulating the argument staticRouteNet leads to stack-based buffer overflow. The attack can be performed remotely, and the exploit is public.
- CVE-2026-36805High
Multiple buffer overflows were discovered in the Tenda G0 device version 15.11.0.5 in the Saveqqlist function via the qqStr and markStr parameters. These vulnerabilities allow an attacker to cause a Denial of Service (DoS) via a crafted HTTP request.
- CVE-2026-36801High
A buffer overflow vulnerability was discovered in the Tenda G0 router version 15.11.0.5 in the IPMacBindRule parameter of the formIPMacBindAdd function. Attackers can cause a Denial of Service (DoS) via a crafted HTTP request.
- CVE-2026-36800High
A buffer overflow vulnerability was discovered in the Tenda G0 router version 15.11.0.5 in the IPMacBindIndex parameter of the formIPMacBindDel function. Attackers can cause a Denial of Service (DoS) via a crafted HTTP request.
- CVE-2026-36799High
Tenda G0 router v15.11.0.5 has a buffer overflow in the portalAuth parameter of formPortalAuth, allowing attackers to cause DoS via crafted HTTP request.
- CVE-2026-36798Medium
Tenda G0 router version 15.11.0.5 contains multiple stack overflows in the formSetDebugCfgr function via the enable, level, and module parameters. Attackers can exploit these to cause a Denial of Service (DoS) via a crafted HTTP request.
- CVE-2026-36797High
Tenda G0 router v15.11.0.5 has a stack overflow in the IPMacBindRuleIp parameter of formIPMacBindModify, allowing attackers to cause DoS via crafted HTTP request.
- CVE-2026-36796High
Tenda G0 router v15.11.0.5 has a stack overflow in the picCropName parameter of formCropAndSetWewifiPic, allowing attackers to cause DoS via crafted HTTP request.
Original NVD description (English source)
A vulnerability was identified in Tenda G0 up to 20260625. This issue affects the function formSetPortMirror of the file /goform/module of the component httpd Web Management Interface. Such manipulation of the argument portMirrorMirroredPorts leads to stack-based buffer overflow. The attack can be executed remotely. The exploit is publicly available and might be used.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS