What is the CVSS score of CVE-2026-36800?

CVE-2026-36800 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

How to fix or mitigate CVE-2026-36800?

Within 24 hours: Identify all Tenda G0 routers running firmware v15.11.0.5 in production and development environments, and assess network exposure (public vs. private). Within 7 days: Implement network access controls to restrict unauthenticated HTTP access to affected devices; enable monitoring for malformed IPMacBindIndex requests; document all discovered instances. Within 30 days: Contact Tenda for patched firmware availability; evaluate interim solutions such as deploying additional redundancy or access-control layers; establish timeline for hardware replacement if no patch is released within 90 days.

Tenda G0 CVE-2026-36800

HIGH

Classic Buffer Overflow (CWE-120)

2026-06-09 mitre

Tenda Denial Of Service Buffer Overflow N A

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 10, 2026 - 19:24 vuln.today

CVSS changed

Jun 10, 2026 - 19:22 NVD

7.5 (HIGH)

CVE Published

Jun 09, 2026 - 00:00 nvd

UNKNOWN (no severity yet)

DescriptionNVD

Shenzhen Tenda Technology Co., Ltd Tenda G0 v15.11.0.5 was discovered to contain a buffer overflow in the IPMacBindIndex parameter of the formIPMacBindDel function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted HTTP request.

AnalysisAI

Denial of service in Tenda G0 router firmware v15.11.0.5 allows remote unauthenticated attackers to crash the device by sending a crafted HTTP request that triggers a buffer overflow in the IPMacBindIndex parameter handler of the formIPMacBindDel function. No public exploit identified at time of analysis, and EPSS exploitation probability is very low (0.01%, 2nd percentile), but the network-reachable, no-auth attack surface on an edge networking device warrants attention from operators of affected hardware.

Technical ContextAI

The flaw resides in formIPMacBindDel, a web-management CGI handler in the Tenda G0 router's HTTP administrative interface used to manage IP/MAC binding rules. The IPMacBindIndex parameter is consumed without sufficient bounds validation, classic of CWE-120 (Classic Buffer Overflow / Buffer Copy without Checking Size of Input), where unbounded copy operations (e.g., strcpy/sprintf on stack buffers) corrupt the call stack of the lighttpd/httpd-equivalent web service typically embedded in Tenda firmware. Tenda's formXxx handler pattern has a long history of similar parameter-overflow defects, and the underlying MIPS-based binary runs as root inside the router, so memory corruption directly affects the privileged web daemon. The CPE entry in NVD is unresolved (cpe:2.3:a:n/a:n/a:*) and does not formally enumerate the device, so version scoping relies on the description's explicit reference to firmware v15.11.0.5.

RemediationAI

No vendor-released patch identified at time of analysis; Tenda has not published an advisory in the provided references. Operators of Tenda G0 routers on firmware 15.11.0.5 should check https://www.tendacn.com for a newer firmware release and apply it once available, and consult the research notes at https://github.com/xhh0124/SemVulLLM/tree/main/G0/formIPMacBindDel for triage. As compensating controls, disable WAN-side remote management entirely (the most effective mitigation, with the trade-off that admins must use LAN access only), restrict the router admin HTTP interface to a specific management VLAN or trusted source IPs via the device's access-control settings (trade-off: added configuration overhead and lockout risk if rules are wrong), and where feasible replace end-of-support Tenda hardware with a vendor that issues timely firmware updates. Generic DoS protection upstream (rate-limiting HTTP requests to the admin interface) can blunt opportunistic abuse but will not prevent a single crafted request from crashing the daemon.