Tenda G0 CVE-2026-19791

The CVSS 4.0 vector specifies PR:L, meaning the attacker must authenticate to the httpd web management interface with at least a low-privilege account before triggering the overflow. The vulnerable endpoint /goform/module must be reachable over the network (AV:N), which is satisfied by default on the LAN interface and may be satisfied on the WAN interface if remote management is enabled - a common misconfiguration on consumer routers. No special non-default feature flag or protocol configuration is required beyond accessing the static route configuration functionality, which is a standard router management feature. Exploitation is limited by: the PR:L authentication requirement (an attacker must possess valid credentials or exploit weak/default credentials); the need for network reachability to the management interface (WAN exposure significantly widens the attack surface); and no additional constraints such as a specific OS platform or co-installed software. No user interaction is required once access is established.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H) assigns a score of 7.4, reflecting network-accessible, low-complexity exploitation requiring low-privilege authentication with full triad impact on the vulnerable system. The E:P exploit maturity modifier confirms a publicly available exploit, which is the most significant practical risk amplifier here. No EPSS score was provided in the intelligence feed, and the vulnerability is absent from CISA KEV, so widespread automated exploitation is not confirmed. However, Tenda consumer routers are frequently deployed with default or weak credentials and with management interfaces exposed on WAN interfaces, which could reduce the effective authentication barrier below what PR:L implies in theory. The combination of a public GitHub PoC, no confirmed patch, and a target class (consumer routers) historically slow to receive updates makes this a genuine priority for any organization with Tenda G0 devices in scope, despite the absence of KEV confirmation.

An attacker with low-privilege credentials to the Tenda G0 web management interface - potentially obtained via default credentials or prior credential theft - sends an HTTP POST request to /goform/module with an oversized value in the staticRouteNet parameter. The addStaticRoute function copies this input into a fixed stack buffer without length validation, overwriting the saved return address. On return, execution redirects to attacker-controlled code, achieving arbitrary command execution on the router with firmware-level privileges. A public proof-of-concept demonstrating this technique is available at https://github.com/lipenghai/iot_bug/blob/main/Tenda/G0/2.md.