What is the CVSS score of CVE-2026-36796?

CVE-2026-36796 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Which versions of Tenda G0 are affected by CVE-2026-36796?

Tenda G0 router firmware v15.11.0.5 contains a remote denial-of-service vulnerability allowing attackers to crash the device via a malformed HTTP request to the web management interface, with no…

How to fix or mitigate CVE-2026-36796?

Within 24 hours: Inventory all Tenda G0 routers running firmware v15.11.0.5 and map exposure on corporate networks. Within 7 days: Contact Tenda support to confirm patch availability and timeline; if unavailable, implement network-layer mitigations (restrict HTTP access to management interface via firewall rules, disable public management access). Within 30 days: Either apply firmware patch when available or plan hardware replacement if vendor cannot provide timeline; establish recurring patching validation.

Tenda G0 CVE-2026-36796

HIGH

Classic Buffer Overflow (CWE-120)

2026-06-09 mitre

Denial Of Service Tenda Buffer Overflow N A

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

Remote unauthenticated HTTP request against the management interface (AV:N/AC:L/PR:N/UI:N) crashes httpd causing availability loss only (A:H), with no confidentiality or integrity impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 10, 2026 - 22:30 vuln.today

CVSS changed

Jun 10, 2026 - 20:22 NVD

7.5 (HIGH)

CVE Published

Jun 09, 2026 - 00:00 nvd

UNKNOWN (no severity yet)

DescriptionNVD

Shenzhen Tenda Technology Co., Ltd Tenda G0 v15.11.0.5 was discovered to contain a stack overflow in the picCropName parameter of the formCropAndSetWewifiPic function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted HTTP request.

AnalysisAI

Denial of service in Tenda G0 router firmware v15.11.0.5 allows remote unauthenticated attackers to crash the device by sending a crafted HTTP request with an oversized picCropName parameter to the formCropAndSetWewifiPic handler. The flaw is a classic stack buffer overflow in the web management interface, and while no public weaponized exploit is identified, proof-of-concept research artifacts are published on GitHub. EPSS scores exploitation probability at just 0.01%, reflecting limited attacker interest despite trivial reachability.

Technical ContextAI

Tenda G0 is a small-business VPN/gateway router from Shenzhen Tenda Technology that exposes a Linux-based embedded web management interface (typically a goahead/httpd-derived daemon). The formCropAndSetWewifiPic handler processes uploaded wireless captive-portal or login-page images and parses the picCropName HTTP parameter into a fixed-size stack buffer without bounds checking, matching CWE-120 (Classic Buffer Overflow / Buffer Copy without Checking Size of Input). On MIPS/ARM SoC firmware typical of these devices, overrunning the stack frame corrupts saved return addresses and immediately crashes the httpd worker, taking the management plane (and frequently routing) offline until reboot.

RemediationAI

No vendor-released patch identified at time of analysis - check https://www.tendacn.com/ for an updated G0 firmware build superseding v15.11.0.5 and apply it as soon as one is published. Until a fixed firmware exists, the most effective compensating control is to disable remote (WAN-side) web administration and ensure UPnP is not exposing the HTTP management port externally, accepting the trade-off that remote support workflows will require VPN access. On the LAN side, restrict access to the management interface to a dedicated admin VLAN or specific source IPs via firewall ACLs, and monitor the device for unexpected reboots or httpd crashes that may indicate exploitation attempts. Reference the researcher's proof-of-concept at https://github.com/xhh0124/SemVulLLM/tree/main/G0/formCropAndSetWewifiPic to derive detection signatures (oversized picCropName values) for IDS/IPS rules.