Tenda G0 CVE-2026-36798

Exploitation requires that an attacker can deliver a crafted HTTP POST request to the Tenda G0 router's formSetDebugCfgr endpoint. The official CVSS vector specifies UI:R (user interaction required), indicating that direct unauthenticated remote exploitation is not the expected attack path - instead, exploitation likely depends on a CSRF-style mechanism where a legitimate administrator with an active authenticated session is tricked into triggering the malicious request by visiting an attacker-controlled page. This means exploitation is limited by the need to social-engineer or otherwise induce router administrator interaction, and is further constrained to devices running firmware v15.11.0.5 specifically. The vulnerability produces only a denial-of-service outcome (device crash or reboot); no confidentiality or integrity impact has been identified, limiting the attacker's gain. Exploitation from the WAN (internet-facing) side is not possible on devices with remote management disabled, which is the default configuration for most SOHO routers.

The CVSS 3.1 base score of 6.5 with vector AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H reflects a network-exploitable, low-complexity flaw with no privileges required but some user interaction needed, and impact limited exclusively to availability. The UI:R metric is significant for a router CGI endpoint - it likely indicates the attack requires a CSRF mechanism where an authenticated administrator must be induced to trigger the crafted request, substantially raising the practical exploitation bar relative to a direct unauthenticated network attack. EPSS is 0.01% (2nd percentile), among the lowest possible exploitation probability scores, indicating very minimal observed real-world exploitation activity at the time of analysis. The vulnerability is not listed in CISA KEV, confirming no confirmed active exploitation. The GitHub repository linked in references may contain PoC material, which should be treated as publicly available exploit code exists until independently verified. Impact is bounded to denial of service - no code execution or data disclosure pathway has been identified - which further limits operational severity. This is a medium-priority finding for exposed SOHO router deployments, not an urgent critical threat, but warrants remediation given the lack of a known patch and the broad deployment footprint of Tenda consumer devices.

An attacker crafts a malicious web page containing a hidden form that submits an HTTP POST request to the Tenda G0 router's formSetDebugCfgr endpoint with an excessively long string in the enable, level, or module parameter field. When a local network administrator with an active router session visits this page, the CSRF-triggered request overflows a fixed stack buffer in the debug handler, corrupting the call stack and crashing the router's management process or causing a full device reboot, denying network service to all connected users. The GitHub repository linked in the CVE references may contain proof-of-concept code demonstrating this technique.