Multiple stack overflows were identified in the formSetDebugCfgr function on the Tenda G0 device. The overflow is triggered by manipulating the enable, level, and module parameters sent in an HTTP request, causing the firmware to crash or become unresponsive. The result is a denial of service condition where the device cannot process legitimate traffic until it is rebooted or re-flashed.

The vulnerability exists in the Shenzhen Tenda Technology Co., Ltd Tenda G0 firmware version 15.11.0.5. No additional firmware versions were listed in the advisory, so only devices running this exact build are known to be affected.

The EPSS score is below 1 % and the flaw is not listed in the CISA KEV catalog, indicating low current exploitation odds. The CVSS score of 6.5 classifies the weakness as moderate severity. Attackers can exploit the vulnerability from the network by sending a crafted HTTP request to the formSetDebugCfgr endpoint; therefore any device exposed to the internet or an untrusted internal network could be targeted.