What is the CVSS score of CVE-2026-36805?

CVE-2026-36805 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Which versions of Tenda G0 are affected by CVE-2026-36805?

Tenda G0 routers running firmware v15.11.0.5 expose organizations to uncontrolled network disruption; attackers can crash affected devices remotely without credentials.

How to fix or mitigate CVE-2026-36805?

24 hours: Inventory all Tenda G0 devices running firmware v15.11.0.5 and document network criticality; check Tenda support for available firmware versions. Within 7 days: Restrict unauthenticated HTTP access to router management interfaces via network segmentation and firewall rules; enable monitoring for abnormal HTTP request patterns. Within 30 days: Monitor Tenda security advisories for patch release; formally request patch timeline from vendor; evaluate replacement or failover routing solutions if vendor patches remain unavailable beyond 90 days.

Tenda G0 CVE-2026-36805

HIGH

Stack-based Buffer Overflow (CWE-121)

2026-06-09 mitre

Denial Of Service Buffer Overflow Stack Overflow Tenda N A

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 10, 2026 - 17:24 vuln.today

CVSS changed

Jun 10, 2026 - 17:22 NVD

7.5 (HIGH)

CVE Published

Jun 09, 2026 - 00:00 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Shenzhen Tenda Technology Co., Ltd Tenda G0 v15.11.0.5 was discovered to contain multiple buffer overflows in the Saveqqlist function via the qqStr and markStr parameters. These vulnerabilities allow attackers to cause a Denial of Service (DoS) via a crafted HTTP request.

AnalysisAI

Denial of service in Tenda G0 router firmware v15.11.0.5 allows remote unauthenticated attackers to crash the device by sending a crafted HTTP request that triggers stack-based buffer overflows in the Saveqqlist function via the qqStr and markStr parameters. CVSS 7.5 reflects the network-reachable, no-privilege availability impact, while EPSS sits at 0.01% (2nd percentile) and no public exploit identified at time of analysis indicates limited near-term opportunistic exploitation despite the easy attack profile.

Technical ContextAI

Tenda G0 is a small-business VPN/gateway router whose web management interface exposes an HTTP endpoint backed by the Saveqqlist handler. The vulnerability is classified as CWE-121 (Stack-based Buffer Overflow): the qqStr and markStr request parameters are copied into fixed-size stack buffers without proper length validation, so an oversized value corrupts the saved return address or adjacent stack frames. Because the affected function lives in the router's embedded HTTP server (typically a single-process httpd on MIPS/ARM firmware), corrupting the stack reliably crashes the management daemon and, depending on watchdog behavior, the device itself. The NVD CPE entry is recorded only as a placeholder (cpe:2.3:a:n/a:n/a:*), so canonical product matching must rely on the description's explicit naming of Tenda G0 firmware v15.11.0.5.

RemediationAI

No vendor-released patch identified at time of analysis - no Tenda advisory or fixed firmware version is present in the provided data. Operators of Tenda G0 v15.11.0.5 should monitor https://www.tendacn.com for a firmware update and apply it once released. As compensating controls, disable remote/WAN-side access to the device's HTTP management interface (this prevents internet-borne exploitation but does not protect against a malicious LAN client), restrict the management interface to a dedicated management VLAN or specific source IPs via ACL (trade-off: legitimate admins must connect from that segment), and place the router behind an upstream firewall or reverse proxy that rejects oversized qqStr/markStr POST parameters (trade-off: requires knowing the exact request shape and may break legitimate save operations if limits are set too tightly). If the qqlist (QQ buddy list) management feature is unused, avoid invoking it; note this is a hardening step, not a fix, since the endpoint remains reachable. The only reference link available for further detail is the researcher's repository at https://github.com/xhh0124/SemVulLLM/tree/main/PW201A/L7IM.