CVE-2026-36800: Tenda G0 Router Buffer Overflow – DoS Vulnerability & Patch Guidance

Technical summary

CVE-2026-36800 is a classic stack-based buffer overflow (CWE-120) located in the formIPMacBindDel function's handling of the IPMacBindIndex parameter. The vulnerability stems from insufficient bounds checking on user-supplied input before copying it into a fixed-size buffer. The attack vector is network-accessible without authentication, making it trivial to exploit from any device with HTTP access to the router's management interface. The resulting memory corruption causes immediate denial of service through process termination or system reboot.

Business impact

Router availability is critical to business continuity. A successful exploit interrupts all downstream network services—email, VoIP, cloud access, and remote work connectivity. For small offices or remote branches relying on a single Tenda G0 unit, this represents a complete network outage. Organizations cannot reliably defend against this without patching, as the attack requires no special privileges or user interaction. Frequency of exploitation depends on attacker proximity to the network and visibility of the device.

Affected systems

Tenda G0 firmware version 15.11.0.5 is confirmed affected. Organizations should verify whether they operate this router model in their network infrastructure, including branch offices, remote sites, or as secondary connectivity. The vendors_products field in the source data is empty, so the scope of affected variants or firmware versions across the product line should be confirmed against Tenda's official security advisory.

Exploitability

Exploitability is very high. The attack requires only network access (no authentication), a standard HTTP client, and knowledge of the parameter name. The payload can be delivered via a single crafted GET or POST request. No user interaction is needed. The barrier to weaponization is low; an attacker with network visibility can launch an attack in minutes. The lack of CVSS Attack Complexity modifiers (AC:L) and the direct denial-of-service outcome make this immediately actionable for threat actors.

Remediation

Firmware patching is the definitive remediation. Verify the availability of a patched firmware release from Tenda and deploy it across all affected G0 units. Until patching is feasible, restrict HTTP access to the router's management interface via network segmentation—limit administrative access to a trusted management VLAN or IP whitelist. Disable remote management if it is not required. Monitor access logs for anomalous HTTP requests to the device.

Patch guidance

Contact Tenda support or check their official security advisory for patched firmware versions greater than 15.11.0.5 for the G0 model. Test patches in a non-production environment before rollout. Verify patch deployment by confirming firmware version in the router's system information panel. For legacy or end-of-life units, determine whether vendor support remains available; if not, consider hardware replacement as part of your network refresh cycle.

Detection guidance

Monitor HTTP traffic to the router's management interface for requests containing the 'IPMacBindIndex' parameter, particularly those with unusually long values or non-standard encoding. Baseline normal IP-MAC binding operations and alert on deviations. Review access logs for failed HTTP requests or unexpected device restarts correlated with management interface access. Network-based anomaly detection on router availability can serve as a tripwire for exploitation attempts.

Why prioritize this

This vulnerability merits high priority due to the combination of network accessibility, lack of authentication, simplicity of exploitation, and direct impact on availability. The CVSS score of 7.5 reflects the severity appropriately. However, organizational impact depends on router deployment: units in critical network paths or serving large user populations warrant immediate patching; units in redundant or non-critical roles may be scheduled within standard maintenance windows, provided they are not directly internet-facing.

Risk score, explained

The CVSS 3.1 score of 7.5 (HIGH) is driven by CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. The network attack vector (AV:N), low complexity (AC:L), and no privilege requirement (PR:N) all lower barriers to exploitation. The unavailability impact (A:H) directly threatens service continuity. The lack of confidentiality or integrity impact (C:N/I:N) prevents a critical rating, but the availability impact is complete for affected devices. Organizations should treat this as a high-priority item that requires remediation within a short timeframe, not a lower-tier issue.

Frequently asked questions