CVE-2026-19792
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk38th percentile - higher than 38% of all known CVEs
Summary
A security flaw has been discovered in Tenda G0 up to 20260625. The function setPortMapping in /goform/module of the httpd web management interface is affected. Manipulating the argument portMappingServer/porMappingtInternal/portMappingExternal results in buffer overflow. The attack can be carried out remotely, and the exploit is public.
Risk Assessment
Buffer overflow could allow a remote attacker to execute arbitrary code or cause a denial of service, potentially disrupting network operations.
Recommendation
Update the Tenda G0 firmware to the latest version if a patch is available. Restrict access to the management interface from external networks.
Other vulnerabilities in Tenda G0
See all- CVE-2026-19791High
A weakness has been identified in Tenda G0 up to 20260625. The function addStaticRoute in /goform/module of the httpd web management interface is affected. Manipulating the argument staticRouteNet leads to stack-based buffer overflow. The attack can be performed remotely, and the exploit is public.
- CVE-2026-19790High
A vulnerability was identified in Tenda G0 up to 20260625. The function formSetPortMirror in /goform/module of the httpd Web Management Interface is affected. Manipulating the argument portMirrorMirroredPorts leads to stack-based buffer overflow. The attack can be executed remotely, and the exploit is publicly available.
- CVE-2026-36805High
Multiple buffer overflows were discovered in the Tenda G0 device version 15.11.0.5 in the Saveqqlist function via the qqStr and markStr parameters. These vulnerabilities allow an attacker to cause a Denial of Service (DoS) via a crafted HTTP request.
- CVE-2026-36801High
A buffer overflow vulnerability was discovered in the Tenda G0 router version 15.11.0.5 in the IPMacBindRule parameter of the formIPMacBindAdd function. Attackers can cause a Denial of Service (DoS) via a crafted HTTP request.
- CVE-2026-36800High
A buffer overflow vulnerability was discovered in the Tenda G0 router version 15.11.0.5 in the IPMacBindIndex parameter of the formIPMacBindDel function. Attackers can cause a Denial of Service (DoS) via a crafted HTTP request.
- CVE-2026-36799High
Tenda G0 router v15.11.0.5 has a buffer overflow in the portalAuth parameter of formPortalAuth, allowing attackers to cause DoS via crafted HTTP request.
- CVE-2026-36798Medium
Tenda G0 router version 15.11.0.5 contains multiple stack overflows in the formSetDebugCfgr function via the enable, level, and module parameters. Attackers can exploit these to cause a Denial of Service (DoS) via a crafted HTTP request.
- CVE-2026-36797High
Tenda G0 router v15.11.0.5 has a stack overflow in the IPMacBindRuleIp parameter of formIPMacBindModify, allowing attackers to cause DoS via crafted HTTP request.
- CVE-2026-36796High
Tenda G0 router v15.11.0.5 has a stack overflow in the picCropName parameter of formCropAndSetWewifiPic, allowing attackers to cause DoS via crafted HTTP request.
Original NVD description (English source)
A security flaw has been discovered in Tenda G0 up to 20260625. Impacted is the function setPortMapping of the file /goform/module of the component httpd web management interface. Performing a manipulation of the argument portMappingServer/porMappingtInternal/portMappingExternal results in buffer overflow. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS