Tenda G0
CVE-2026-36796
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach Tenda G0 HTTP management interface
-
DeliveryCraft POST to formCropAndSetWewifiPic
-
ExploitSend oversized picCropName parameter
-
ExecutionOverflow stack buffer in handler
-
PersistCrash httpd and reboot device
-
ImpactSustain DoS by repeating request
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Buffer copy size validation
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Attacker must be able to reach the Tenda G0 HTTP management interface and send a POST request to the formCropAndSetWewifiPic handler with an oversized picCropName parameter; no credentials or user interaction are required per the CVSS vector (PR:N/UI:N). The principal limiting factor is exposure of the web management interface: on default Tenda G0 deployments the admin UI listens on the LAN only, so internet-based exploitation requires that remote/WAN management has been explicitly enabled or that the port has been forwarded. The affected firmware build is specifically v15.11.0.5; other firmware versions are not confirmed vulnerable from the supplied data. |
| Impact | The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H scores 7.5 (High) and is consistent with the description: remote, unauthenticated, low-complexity, availability-only impact. EPSS, however, places exploitation probability at 0.01% (2nd percentile), and the CVE is not on CISA KEV, signalling that real-world attacker interest is minimal - typical for DoS-only flaws in SOHO router firmware where attackers tend to prioritise RCE chains. The research repository on GitHub suggests reproduction tooling exists, but no weaponised exploit or in-the-wild abuse is confirmed. The most material caveat is reachability: Tenda web UIs are usually LAN-only by default, so the AV:N rating only translates to real risk where the WAN admin interface has been enabled or exposed via UPnP/port-forwarding. Treat this as a moderate hardening item for exposed devices, not an emergency. |
| Exploit ScenarioDerived | An attacker on the same LAN - or on the internet if the WAN admin interface is enabled - sends a single crafted HTTP POST to the formCropAndSetWewifiPic endpoint with an overlong picCropName value, overflowing the stack buffer and crashing the embedded httpd, which on many Tenda devices cascades to a full device reboot. Repeating the request in a loop keeps the router and its routed clients offline. Proof-of-concept research is publicly available on GitHub, lowering the bar for reproduction. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 10, 2026
Denial of service in Tenda G0 router firmware v15.11.0.5 allows remote unauthenticated attackers to crash the device by sending a crafted HTTP request with an oversized picCropName parameter to the formCropAndSetWewifiPic handler. The flaw is a classic stack buffer overflow in the web management interface, and while no public weaponized exploit is identified, proof-of-concept research artifacts are published on GitHub. EPSS scores exploitation probability at just 0.01%, reflecting limited attacker interest despite trivial reachability.
RemediationAI
No vendor-released patch identified at time of analysis - check https://www.tendacn.com/ for an updated G0 firmware build superseding v15.11.0.5 and apply it as soon as one is published. Until a fixed firmware exists, the most effective compensating control is to disable remote (WAN-side) web administration and ensure UPnP is not exposing the HTTP management port externally, accepting the trade-off that remote support workflows will require VPN access. On the LAN side, restrict access to the management interface to a dedicated admin VLAN or specific source IPs via firewall ACLs, and monitor the device for unexpected reboots or httpd crashes that may indicate exploitation attempts. Reference the researcher's proof-of-concept at https://github.com/xhh0124/SemVulLLM/tree/main/G0/formCropAndSetWewifiPic to derive detection signatures (oversized picCropName values) for IDS/IPS rules.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Tenda G0 is a small-business VPN/gateway router from Shenzhen Tenda Technology that exposes a Linux-based embedded web management interface (typically a goahead/httpd-derived daemon). The formCropAndSetWewifiPic handler processes uploaded wireless captive-portal or login-page images and parses the picCropName HTTP parameter into a fixed-size stack buffer without bounds checking, matching CWE-120 (Classic Buffer Overflow / Buffer Copy without Checking Size of Input). On MIPS/ARM SoC firmware typical of these devices, overrunning the stack frame corrupts saved return addresses and immediately crashes the httpd worker, taking the management plane (and frequently routing) offline until reboot.
Know when N A gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Remote unauthenticated HTTP request against the management interface (AV:N/AC:L/PR:N/UI:N) crashes httpd causing availability loss only (A:H), with no confidentiality or integrity impact.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
2DescriptionCVE.org
Shenzhen Tenda Technology Co., Ltd Tenda G0 v15.11.0.5 was discovered to contain a stack overflow in the picCropName parameter of the formCropAndSetWewifiPic function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted HTTP request.
Executive ViewAI
Tenda G0 router firmware v15.11.0.5 contains a remote denial-of-service vulnerability allowing attackers to crash the device via a malformed HTTP request to the web management interface, with no authentication required. This affects network infrastructure availability and could disrupt business operations if deployed in production environments. While exploitation probability is very low (0.01% per EPSS), the trivial attack vector and lack of available patches require prompt defensive action.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Restrict HTTP management interface access via firewall to authorized administrative networks only; (2) Implement network segmentation to isolate routers from untrusted segments; (3) Monitor device availability and implement automated restart schedules; (4) Escalate with Tenda support for patch ETA and consider hardware refresh for production-critical router deployments.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Affected Products (CPE)CVE.org
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Exploit-DB