What is the CVSS score of CVE-2026-36797?

CVE-2026-36797 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Which versions of Tenda G0 are affected by CVE-2026-36797?

Tenda G0 routers running firmware v15.11.0.5 are vulnerable to a remote denial-of-service attack that requires no authentication, potentially disrupting network connectivity across dependent systems.

How to fix or mitigate CVE-2026-36797?

Within 24 hours: Identify all Tenda G0 routers running firmware v15.11.0.5 and document their network location and criticality. Within 7 days: Implement network-level compensating controls including firewall rules to restrict HTTP access to management interfaces and rate limiting on incoming HTTP requests. Within 30 days: Contact Tenda for patch timeline; if unavailable, evaluate alternative router models from vendors with established patch management practices or begin procurement for replacement hardware.

Tenda G0 CVE-2026-36797

HIGH

Classic Buffer Overflow (CWE-120)

2026-06-09 mitre

Denial Of Service Tenda Buffer Overflow N A

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

Single crafted HTTP request to an unauthenticated web form handler causes a crash, so AV:N/AC:L/PR:N/UI:N; impact is availability-only with no confirmed code execution.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 10, 2026 - 22:30 vuln.today

CVSS changed

Jun 10, 2026 - 20:22 NVD

7.5 (HIGH)

CVE Published

Jun 09, 2026 - 00:00 nvd

UNKNOWN (no severity yet)

DescriptionNVD

Shenzhen Tenda Technology Co., Ltd Tenda G0 v15.11.0.5 was discovered to contain a stack overflow in the IPMacBindRuleIp parameter of the formIPMacBindModify function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted HTTP request.

AnalysisAI

Denial of service in Tenda G0 router firmware v15.11.0.5 allows remote unauthenticated attackers to crash the device by sending a crafted HTTP request that triggers a stack buffer overflow in the formIPMacBindModify handler via the IPMacBindRuleIp parameter. No public exploit identified at time of analysis, EPSS is very low (0.01%), and SSVC reports no observed exploitation, though CISA's SSVC marks the attack as automatable with partial technical impact.

Technical ContextAI

The vulnerability resides in the formIPMacBindModify CGI handler of the Tenda G0 SOHO/business router web management interface, which parses IP-MAC binding rules submitted via HTTP. The IPMacBindRuleIp parameter is copied into a fixed-size stack buffer without proper length validation, matching the CWE-120 classic buffer overflow ('Classic Buffer Overflow') root cause where bounds checking is missing on a string copy. This is a recurring class of bug in Tenda's web administration binaries (httpd/goahead-style handlers), where user-supplied form fields are passed directly to unsafe string operations such as strcpy/sprintf, corrupting saved frame state and typically crashing the embedded HTTP daemon.

RemediationAI

No vendor-released patch identified at time of analysis - there is no Tenda security bulletin in the provided references. Operators should check the Tenda support site for a firmware update newer than 15.11.0.5 for the G0 model and apply it as soon as one is published. As compensating controls, disable remote/WAN-side web management on the device (Tenda's 'Remote Web Management' setting) so the formIPMacBindModify endpoint is not reachable from the internet, and restrict LAN access to the administrative interface to a trusted management VLAN or specific source IPs via an upstream firewall; the trade-off is loss of remote administration convenience. If the IP-MAC binding feature is not in use, leaving it unconfigured does not remove the vulnerable parser, so network-level access restriction is the primary mitigation. Monitor the referenced research repository (https://github.com/xhh0124/SemVulLLM/tree/main/G0/formIPMacBindModify) and Tenda advisories for a confirmed fixed version.