Executive brief
Tenda G0 routers contain a buffer overflow vulnerability in the web management interface's port mirroring configuration function. An attacker can remotely send a specially crafted request with an oversized portMirrorMirroredPorts parameter to crash the device or execute arbitrary code, compromising the router's availability and security.
Technical details
A stack-based buffer overflow exists in the formSetPortMirror function within the httpd web management interface (/goform/module endpoint). The vulnerability occurs because the portMirrorMirroredPorts parameter is read from user input and passed directly to sprintf() without length validation, writing into a fixed 256-byte stack buffer. An attacker can exploit this remotely by sending an HTTP request with a crafted portMirrorMirroredPorts value exceeding the buffer size. Successful exploitation can lead to memory corruption, denial of service, or arbitrary code execution. A patch is available and the exploit is publicly disclosed.
Affected products
- Tenda G0 up to 20260625
Timeline
- 2026-08-14: disclosed: Published on NVD
- 2026-08-14: other: Exploit publicly available on GitHub