Tenda G0 CVE-2026-19792

Exploitation requires network-level access to the Tenda G0 httpd web management interface and possession of at least low-privilege management credentials (CVSS PR:L) - unauthenticated exploitation is not supported by the provided vector. The vulnerable endpoint is specifically /goform/module, triggered by the setPortMapping handler. If the web management interface is exposed on the WAN interface (a common misconfiguration on SOHO devices), exploitation becomes practical from the public internet for any attacker holding valid credentials. Exploitation is constrained by the PR:L prerequisite: attackers must first obtain management credentials via default passwords, credential stuffing, or other means before the buffer overflow can be triggered. Attack complexity is low (AC:L), meaning no race conditions, heap grooming, or special timing windows are required once credentials are in hand.

The CVSS 4.0 base score of 7.4 is driven by AV:N (network-reachable management interface), AC:L (no race condition or special timing required), PR:L (low-privilege credentials sufficient), and high VC/VI/VA impact, reflecting full compromise potential of the device. The E:P exploitation metric is the most operationally significant signal - a working PoC has been published, meaning exploitation is accessible to script-level attackers, not just sophisticated threat actors. No CISA KEV listing is present, so mass exploitation is not confirmed; however, SOHO routers with publicly available exploits historically attract opportunistic scanning campaigns within days of disclosure. EPSS data was not included in the provided intelligence and cannot be assessed. The low attack complexity combined with the public PoC means even a mid-sized municipal IT team in leszno managing a fleet of Tenda devices should treat this as an urgent remediation priority rather than a routine patch cycle item. The PR:L requirement is the primary limiting factor - unauthenticated exploitation is not supported by the CVSS vector, meaning default credential exposure or credential theft is a prerequisite.

An attacker with access to valid low-privilege management credentials - obtained through credential reuse, default password exploitation, or phishing - sends a crafted HTTP POST request to the /goform/module endpoint of the Tenda G0 web interface with an abnormally long portMappingServer or portMappingExternal parameter value. The oversized input overflows the fixed-size buffer in the setPortMapping function, overwriting control data on the stack or heap and potentially redirecting execution to attacker-controlled code running with the privileges of the httpd process. A working proof-of-concept demonstrating this technique is publicly available at https://github.com/lipenghai/iot_bug/blob/main/Tenda/G0/3.md.