CVE-2026-36805
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk23th percentile - higher than 23% of all known CVEs
Summary
Multiple buffer overflows were discovered in the Tenda G0 device version 15.11.0.5 in the Saveqqlist function via the qqStr and markStr parameters. These vulnerabilities allow an attacker to cause a Denial of Service (DoS) via a crafted HTTP request.
Risk Assessment
An attacker can remotely crash the device, leading to network disruption and loss of services provided by the router.
Recommendation
Immediately update the Tenda G0 firmware to the latest version available from the vendor. If no update is available, restrict management interface access to trusted networks only.
Other vulnerabilities in Tenda G0
See all- CVE-2026-19792High
A security flaw has been discovered in Tenda G0 up to 20260625. The function setPortMapping in /goform/module of the httpd web management interface is affected. Manipulating the argument portMappingServer/porMappingtInternal/portMappingExternal results in buffer overflow. The attack can be carried out remotely, and the exploit is public.
- CVE-2026-19791High
A weakness has been identified in Tenda G0 up to 20260625. The function addStaticRoute in /goform/module of the httpd web management interface is affected. Manipulating the argument staticRouteNet leads to stack-based buffer overflow. The attack can be performed remotely, and the exploit is public.
- CVE-2026-19790High
A vulnerability was identified in Tenda G0 up to 20260625. The function formSetPortMirror in /goform/module of the httpd Web Management Interface is affected. Manipulating the argument portMirrorMirroredPorts leads to stack-based buffer overflow. The attack can be executed remotely, and the exploit is publicly available.
- CVE-2026-36801High
A buffer overflow vulnerability was discovered in the Tenda G0 router version 15.11.0.5 in the IPMacBindRule parameter of the formIPMacBindAdd function. Attackers can cause a Denial of Service (DoS) via a crafted HTTP request.
- CVE-2026-36800High
A buffer overflow vulnerability was discovered in the Tenda G0 router version 15.11.0.5 in the IPMacBindIndex parameter of the formIPMacBindDel function. Attackers can cause a Denial of Service (DoS) via a crafted HTTP request.
- CVE-2026-36799High
Tenda G0 router v15.11.0.5 has a buffer overflow in the portalAuth parameter of formPortalAuth, allowing attackers to cause DoS via crafted HTTP request.
- CVE-2026-36798Medium
Tenda G0 router version 15.11.0.5 contains multiple stack overflows in the formSetDebugCfgr function via the enable, level, and module parameters. Attackers can exploit these to cause a Denial of Service (DoS) via a crafted HTTP request.
- CVE-2026-36797High
Tenda G0 router v15.11.0.5 has a stack overflow in the IPMacBindRuleIp parameter of formIPMacBindModify, allowing attackers to cause DoS via crafted HTTP request.
- CVE-2026-36796High
Tenda G0 router v15.11.0.5 has a stack overflow in the picCropName parameter of formCropAndSetWewifiPic, allowing attackers to cause DoS via crafted HTTP request.
Original NVD description (English source)
Shenzhen Tenda Technology Co., Ltd Tenda G0 v15.11.0.5 was discovered to contain multiple buffer overflows in the Saveqqlist function via the qqStr and markStr parameters. These vulnerabilities allow attackers to cause a Denial of Service (DoS) via a crafted HTTP request.