Tenda G0 CVE-2026-19790

The CVSS 4.0 vector specifies PR:L - exploitation requires low-privilege authenticated access to the Tenda G0 httpd web management interface; unauthenticated remote exploitation is not supported by the available data. The vulnerability is triggered specifically through the Port Mirror configuration feature: the attacker must submit a POST request to the /goform/module endpoint with an oversized portMirrorMirroredPorts parameter, meaning the Port Mirroring functionality of the management interface must be accessible to the authenticated session. Network reachability to the device's HTTP management port is required. Limiting factors: valid credentials (at any privilege level) must be obtained first; the management interface must not be firewalled from the attacker's position; and exploitation behavior on firmwares with stack canaries or ASLR (if any) is not addressed in available sources.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H) scores 7.4 and indicates network-reachable, low-complexity exploitation requiring low-privilege authentication, with full impact across confidentiality, integrity, and availability. The E:P supplemental metric reflects the confirmed public proof-of-concept. No CISA KEV listing exists, so confirmed active exploitation at scale is not established - however, the public PoC and the historically weak exploit mitigations on consumer Tenda firmware make this a credible near-term exploitation risk. Any organization running Tenda G0 devices with the management interface exposed to untrusted networks - even a mid-sized network operator in radom deploying these as CPE devices - should treat remediation as urgent given the trivial post-auth exploitation path. EPSS data was not provided in the input; risk prioritization relies on CVSS vector, E:P tag, and PoC availability. The PR:L requirement is a partial mitigating factor - credential theft or default credential use could bridge this gap on poorly managed devices.

An attacker who has obtained low-privilege credentials to the Tenda G0 management interface - via credential stuffing against default credentials or lateral movement - sends a crafted HTTP POST request to /goform/module with a portMirrorMirroredPorts value far exceeding the expected buffer size. The formSetPortMirror function copies this input onto the stack without bounds checking, overwriting the return address and enabling control-flow hijack or device crash. A public proof-of-concept demonstrating this technique is available at https://github.com/lipenghai/iot_bug/blob/main/Tenda/G0/1.md, providing a ready template for exploitation.