CVE-2026-36798
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
Tenda G0 router version 15.11.0.5 contains multiple stack overflows in the formSetDebugCfgr function via the enable, level, and module parameters. Attackers can exploit these to cause a Denial of Service (DoS) via a crafted HTTP request.
Risk Assessment
An attacker can cause the router to crash, leading to network disruption and loss of connectivity.
Recommendation
Contact the vendor for a firmware update or apply temporary access restrictions to the management interface.
Other vulnerabilities in Tenda G0
See all- CVE-2026-19792High
A security flaw has been discovered in Tenda G0 up to 20260625. The function setPortMapping in /goform/module of the httpd web management interface is affected. Manipulating the argument portMappingServer/porMappingtInternal/portMappingExternal results in buffer overflow. The attack can be carried out remotely, and the exploit is public.
- CVE-2026-19791High
A weakness has been identified in Tenda G0 up to 20260625. The function addStaticRoute in /goform/module of the httpd web management interface is affected. Manipulating the argument staticRouteNet leads to stack-based buffer overflow. The attack can be performed remotely, and the exploit is public.
- CVE-2026-19790High
A vulnerability was identified in Tenda G0 up to 20260625. The function formSetPortMirror in /goform/module of the httpd Web Management Interface is affected. Manipulating the argument portMirrorMirroredPorts leads to stack-based buffer overflow. The attack can be executed remotely, and the exploit is publicly available.
- CVE-2026-36805High
Multiple buffer overflows were discovered in the Tenda G0 device version 15.11.0.5 in the Saveqqlist function via the qqStr and markStr parameters. These vulnerabilities allow an attacker to cause a Denial of Service (DoS) via a crafted HTTP request.
- CVE-2026-36801High
A buffer overflow vulnerability was discovered in the Tenda G0 router version 15.11.0.5 in the IPMacBindRule parameter of the formIPMacBindAdd function. Attackers can cause a Denial of Service (DoS) via a crafted HTTP request.
- CVE-2026-36800High
A buffer overflow vulnerability was discovered in the Tenda G0 router version 15.11.0.5 in the IPMacBindIndex parameter of the formIPMacBindDel function. Attackers can cause a Denial of Service (DoS) via a crafted HTTP request.
- CVE-2026-36799High
Tenda G0 router v15.11.0.5 has a buffer overflow in the portalAuth parameter of formPortalAuth, allowing attackers to cause DoS via crafted HTTP request.
- CVE-2026-36797High
Tenda G0 router v15.11.0.5 has a stack overflow in the IPMacBindRuleIp parameter of formIPMacBindModify, allowing attackers to cause DoS via crafted HTTP request.
- CVE-2026-36796High
Tenda G0 router v15.11.0.5 has a stack overflow in the picCropName parameter of formCropAndSetWewifiPic, allowing attackers to cause DoS via crafted HTTP request.
Original NVD description (English source)
Shenzhen Tenda Technology Co., Ltd Tenda G0 v15.11.0.5 was discovered to contain multiple stack overflows in the formSetDebugCfgr function via the enable, level, and module parameters. These vulnerabilities allow attackers to cause a Denial of Service (DoS) via a crafted HTTP request.