Description
A vulnerability was identified in Tenda G0 up to 20260625. This issue affects the function formSetPortMirror of the file /goform/module of the component httpd Web Management Interface. Such manipulation of the argument portMirrorMirroredPorts leads to stack-based buffer overflow. The attack can be executed remotely. The exploit is publicly available and might be used.
Published: 2026-08-14
Score: 8.7 High
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A stack‑based buffer overflow exists in the Tenda G0 web management interface, specifically within the formSetPortMirror function that processes the portMirrorMirroredPorts parameter. This vulnerability enables an attacker to corrupt data on the stack and send malicious payloads through HTTP POST requests to the /goform/module endpoint. If the overflow succeeds, the attacker could obtain the privileges of the web server process, allowing execution of arbitrary code on the device.

Affected Systems

All Tenda G0 routers with firmware versions up to 20260625 are affected. The flaw is confined to the httpd component’s handling of formSetPortMirror requests and does not depend on any specific model within the G0 series.

Risk and Exploitability

The CVSS score of 8.7 classifies this vulnerability as high severity, and an exploit is publicly available, indicating a real threat. Although the EPSS score is not reported and the issue is not yet listed in the CISA KEV catalog, the remote nature of the attack and the possibility of arbitrary code execution mean that routers remain highly vulnerable until a fix is applied.

Generated by OpenCVE AI on August 14, 2026 at 05:20 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update the router firmware to a version that resolves the buffer overflow in formSetPortMirror.
  • If a patch is not available, block or restrict external access to the /goform/module endpoint or disable the port mirroring feature entirely.
  • Monitor device logs for unexpected POST requests to /goform/module and investigate any anomalous activity promptly.

Generated by OpenCVE AI on August 14, 2026 at 05:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 14 Aug 2026 03:45:00 +0000

Type Values Removed Values Added
Description A vulnerability was identified in Tenda G0 up to 20260625. This issue affects the function formSetPortMirror of the file /goform/module of the component httpd Web Management Interface. Such manipulation of the argument portMirrorMirroredPorts leads to stack-based buffer overflow. The attack can be executed remotely. The exploit is publicly available and might be used.
Title Tenda G0 httpd Web Management module formSetPortMirror stack-based overflow
First Time appeared Tenda
Tenda g0
Weaknesses CWE-119
CWE-121
CPEs cpe:2.3:h:tenda:g0:*:*:*:*:*:*:*:*
Vendors & Products Tenda
Tenda g0
References
Metrics cvssV2_0

{'score': 9, 'vector': 'AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 8.8, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Tenda G0
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-08-14T03:30:10.585Z

Reserved: 2026-08-13T18:55:20.872Z

Link: CVE-2026-19790

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-14T04:16:40.780

Modified: 2026-08-14T04:16:40.780

Link: CVE-2026-19790

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-14T05:30:16Z

Weaknesses
  • CWE-119

    Improper Restriction of Operations within the Bounds of a Memory Buffer

  • CWE-121

    Stack-based Buffer Overflow