Executive brief
Tenda G0 routers are affected by a security flaw in their web management interface. By sending a specially crafted web request, an attacker can crash the device or potentially take full control of it. This could lead to a complete loss of internet connectivity for the network and allow unauthorized access to sensitive data passing through the router.
Technical details
A vulnerability exists in the formSetDebugCfgr (and related formPortalAuth) function within Tenda G0 v15.11.0.5 firmware. The issue stems from the unsafe use of sprintf() to process the 'enable', 'level', and 'module' HTTP parameters retrieved via websGetVar. An attacker can exploit this by sending a crafted HTTP request containing overly long strings to trigger a stack-based buffer overflow, or by including shell metacharacters to achieve command injection via a subsequent system() call. This allows for unauthenticated remote code execution (RCE) or a Denial of Service (DoS) condition. While the NVD summary focuses on DoS, the researcher's technical analysis confirms arbitrary code execution is possible.
Affected products
- Tenda G0 v15.11.0.5
Timeline
- 2026-03-17: other: CVE request submitted to MITRE
- 2026-06-06: disclosed: Public disclosure
- 2026-06-09: advisory: NVD advisory published