What is the CVSS score of CVE-2026-36799?

CVE-2026-36799 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Which versions of Tenda G0 are affected by CVE-2026-36799?

Tenda G0 router firmware v15.11.0.5 contains a denial of service vulnerability allowing remote attackers to crash affected devices and disrupt network connectivity.

How to fix or mitigate CVE-2026-36799?

Within 24 hours: Inventory all Tenda G0 routers running firmware v15.11.0.5 and assess network criticality of each device. Within 7 days: Implement firewall rules restricting external HTTP/HTTPS access to affected routers and segregate them from critical network segments. Within 30 days: Complete remediation by replacing affected hardware with alternative vendor solutions or establishing permanent IDS/IPS detection signatures for malformed HTTP requests targeting the portalAuth parameter.

Tenda G0 CVE-2026-36799

HIGH

Classic Buffer Overflow (CWE-120)

2026-06-09 mitre

Buffer Overflow Tenda Denial Of Service N A

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

Network-reachable HTTP endpoint, no auth or interaction, single crafted request triggers the overflow; impact is availability only (service crash), no confidentiality or integrity loss.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 10, 2026 - 20:22 vuln.today

CVSS changed

Jun 10, 2026 - 20:22 NVD

7.5 (HIGH)

CVE Published

Jun 09, 2026 - 00:00 nvd

UNKNOWN (no severity yet)

DescriptionNVD

Shenzhen Tenda Technology Co., Ltd Tenda G0 v15.11.0.5 was discovered to contain a buffer overflow in the portalAuth parameter of the formPortalAuth function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted HTTP request.

AnalysisAI

Denial of service in Tenda G0 router firmware v15.11.0.5 allows remote unauthenticated attackers to crash the device by sending a crafted HTTP request that overflows the portalAuth parameter handled by the formPortalAuth function. No public exploit is identified at time of analysis and EPSS exploitation probability is very low (0.01%), but a public proof-of-concept research repository on GitHub references the vulnerable function.

Technical ContextAI

The Tenda G0 is a small-business VPN router whose embedded HTTP management/portal interface exposes the formPortalAuth handler. The flaw is a classic CWE-120 classic buffer copy without checking size of input: the portalAuth parameter taken from an HTTP request is copied into a fixed-size stack or heap buffer without bounds validation, leading to memory corruption. Because the affected component is a C-based embedded web server on MIPS/ARM firmware (typical Tenda architecture), corrupting the stack reliably crashes the httpd process and, by extension, the router's management plane. The supplied CPE string (cpe:2.3:a:n/a:n/a) is a placeholder and does not encode the actual product; the description is the authoritative source for affected firmware.

RemediationAI

No vendor-released patch identified at time of analysis and no Tenda advisory is linked in the available references, so monitor https://www.tendacn.com/ for a firmware release that supersedes 15.11.0.5 and apply it once published. As compensating controls, restrict access to the router's HTTP management/portal interface to a trusted management VLAN or specific admin IPs via the device ACL, and ensure WAN-side administration is disabled (default on most Tenda models) - trade-off is loss of remote administration convenience. If the captive-portal authentication feature is not in use, disable it to remove the formPortalAuth attack surface entirely; the side effect is loss of portal-based guest auth. Place the device behind an upstream firewall that drops unsolicited inbound HTTP to the router's management ports, and monitor for repeated httpd crashes/reboots as an indicator of exploitation attempts. Reference research material: https://github.com/xhh0124/SemVulLLM/tree/main/G0/formPortalAuth.