CVE-2026-36799: Tenda G0 Buffer Overflow DoS Vulnerability – Firmware Update Required

Technical summary

CVE-2026-36799 is a classic buffer overflow vulnerability (CWE-120) located in the formPortalAuth function of Tenda G0 firmware v15.11.0.5. The portalAuth parameter fails to validate input length before writing to a stack or heap buffer, allowing an attacker to send an oversized HTTP request payload. The resulting memory corruption causes the device to terminate or become unresponsive. The attack vector is network-based with no prerequisites—any remote actor can trigger the condition without credentials or user interaction.

Business impact

Affected routers can be knocked offline by remote attackers, disrupting internet connectivity for home or small office networks. In environments where Tenda G0 devices provide critical network access, this vulnerability enables business disruption and potential data loss if dependent services are interrupted. The ease of exploitation (network-accessible, no auth required) makes this a nuisance vector for competitors, disgruntled users, or opportunistic threat actors. Recovery typically requires manual reboot of the device.

Affected systems

Tenda G0 routers running firmware version 15.11.0.5 are confirmed vulnerable. Users should verify whether their device is running this specific firmware version via the device's web interface or documentation. Tenda may have released updated firmware since publication; check Tenda's official support site for the latest available version.

Exploitability

This vulnerability is straightforward to exploit and requires only network access—no authentication, no complex setup, no user interaction needed. Any attacker with layer-3 connectivity to the affected router can craft and send a malicious HTTP request. The low attack complexity and accessibility make opportunistic exploitation likely. However, exploitation is limited to Denial of Service; the attacker cannot steal data or gain administrative control of the device.

Remediation

Immediately check your Tenda G0 firmware version and upgrade to the latest available release from Tenda if your device is running v15.11.0.5 or earlier. Verify the update on Tenda's official support portal to ensure you obtain a patched firmware version. As an interim measure, restrict network access to the router's web interface if possible, though this does not fully mitigate the risk if the vulnerable function is reachable via other network services.

Patch guidance

Visit Tenda's official support website and locate the latest firmware release for your G0 model. Download the correct firmware file, access the router's admin panel (typically via http://192.168.0.1), navigate to System Tools or Firmware Upgrade, and follow the on-screen prompts to apply the update. Do not power off the router during the update process. After the upgrade completes and the device reboots, verify the new firmware version is installed before resuming normal operations. If you are unsure of your current version, check Settings or System Information in the router's web interface.

Detection guidance

Monitor network traffic for unusually large or malformed HTTP requests directed at the router's management port (typically 80 or 8080). Examine router logs for crashes, restarts, or access attempts to the /portalAuth endpoint with oversized payloads. If your router becomes unresponsive or reboots unexpectedly without user action, it may indicate exploitation attempts. Implement network-level controls (ACLs, firewall rules) to limit which hosts can reach the router's management interface. Consider deploying an IDS/IPS rule that detects oversized HTTP requests to portal or authentication endpoints.

Why prioritize this

Although the CVSS score of 7.5 (HIGH) reflects only Denial of Service impact, the vulnerability's trivial exploitability and lack of prerequisites warrant immediate attention. Devices remain online but unusable when successfully attacked. Organizations relying on Tenda G0 routers for network continuity should prioritize patching to restore service availability and prevent disruption. The combination of network accessibility and no authentication requirement makes this a high-priority attack surface that threat actors will test.

Risk score, explained

The CVSS v3.1 score of 7.5 (HIGH) stems from a network attack vector, low attack complexity, no privileges required, and no user interaction—all of which maximize reach and ease. However, the impact scope is limited to availability (Denial of Service); confidentiality and integrity are not affected. If the device were exploitable for remote code execution or credential theft, the score would be critical. As-is, the HIGH severity reflects the practical risk of service disruption combined with ease of attack, not the severity of data compromise.

Frequently asked questions