Executive brief
The Tenda G0 router contains a security flaw in how it handles certain web requests. By sending a specially crafted message to the device, an attacker can crash the router or potentially take full control of it. This could lead to a complete loss of internet connectivity for the network or unauthorized access to data passing through the device.
Technical details
A stack-based buffer overflow exists in the Tenda G0 v15.11.0.5 firmware within the 'formCropAndSetWewifiPic' function. The vulnerability is triggered when the 'picCropName' HTTP parameter, retrieved via 'websGetVar', is passed to 'sprintf' and 'snprintf' without adequate length validation. An attacker can exploit this by sending a crafted HTTP request with an excessively long string (e.g., over 800 characters) to the affected CGI endpoint. This can lead to a process crash (Denial of Service) or arbitrary code execution with the privileges of the web service. While the NVD entry focuses on DoS, researcher analysis indicates the potential for full system compromise via command injection or stack smashing.
Affected products
- Tenda G0 v15.11.0.5
Timeline
- 2026-03-17: other: CVE request submitted to MITRE
- 2026-06-06: disclosed: Public disclosure of vulnerability details
- 2026-06-09: advisory: NVD published CVE-2026-36796