CVE-2026-36805: Tenda G0 Buffer Overflow Denial of Service Vulnerability

Technical summary

CVE-2026-36805 is a stack-based buffer overflow vulnerability (CWE-121) in the Saveqqlist function of Tenda G0 v15.11.0.5. The vulnerability exists in the processing of the qqStr and markStr HTTP parameters. Insufficient input validation allows attackers to overwrite stack memory with controlled data, resulting in uncontrolled process termination. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) reflects network-accessible, unauthenticated attack surface with high availability impact.

Business impact

Tenda G0 routers are commonly deployed as edge network devices in small offices and home networks. A successful DoS attack renders the device inoperable, interrupting internet connectivity and any services dependent on it. For organizations relying on these routers for branch office or remote site connectivity, such outages can cascade into broader business disruption. The ease of exploitation increases the likelihood of opportunistic attacks at scale.

Affected systems

This vulnerability affects Tenda G0 firmware version 15.11.0.5. Organizations should inventory Tenda G0 devices and determine their current firmware versions. The vulnerability description does not enumerate all affected firmware versions; users of other G0 versions should consult Tenda's official security advisories to determine whether they are in scope.

Exploitability

This vulnerability is readily exploitable. It requires only network access, no authentication, and no user interaction. An attacker can craft a malicious HTTP request targeting the vulnerable Saveqqlist function and send it to any exposed Tenda G0 device. The low attack complexity and lack of privilege or interaction requirements make this attractive for automated scanning and opportunistic exploitation. However, the vulnerability is not currently listed on the CISA Known Exploited Vulnerabilities (KEV) catalog, suggesting active exploitation in the wild has not been widely documented at this time.

Remediation

Apply the latest firmware update from Tenda that patches the buffer overflow in the Saveqqlist function. Verify the patched version against Tenda's official security advisory to confirm the fix is included. As an interim measure, restrict HTTP access to the device's management interface using firewall rules, network segmentation, or access control lists to limit exposure to potential attackers.

Patch guidance

Check Tenda's official support website and security advisories for firmware updates addressing CVE-2026-36805. Firmware updates for Tenda G0 devices are typically deployed through the device's web interface (Settings > Firmware Upgrade) or via a downloadable image from Tenda's support portal. Before applying any update, back up your device configuration. Test updates in a non-production environment if feasible. Document the pre-patch and post-patch firmware versions for compliance and change management records.

Detection guidance

Monitor for HTTP POST/GET requests to the Tenda G0 device containing suspicious parameters named 'qqStr' or 'markStr' with unusually long payloads or binary data. Check device logs for unexpected reboots or process crashes coinciding with HTTP requests. Network-based detection can identify scanning patterns targeting Tenda G0 devices on standard HTTP ports. Intrusion detection systems may flag attempts to overflow stack buffers via web parameters. Device uptime monitoring can alert to unexpected restarts caused by DoS attacks.

Why prioritize this

Although this vulnerability is not yet on the CISA KEV catalog, it warrants high priority due to its accessibility (network-based, no authentication), high availability impact, and the prevalence of Tenda G0 routers in distributed network architectures. The unauthenticated DoS vector poses immediate operational risk. Organizations with Tenda G0 devices in production should prioritize patching within 30 days to reduce exposure before the vulnerability becomes more widely known or exploited.

Risk score, explained

The CVSS 3.1 score of 7.5 (HIGH) reflects high attack accessibility combined with full availability impact. The vulnerability lacks integrity or confidentiality impact (no data exfiltration or modification), but the ability to remotely crash network equipment without authentication justifies the elevated score. The score does not account for real-world factors such as device prevalence or attacker motivation, which may elevate or lower risk depending on your environment.

Frequently asked questions