Tenda G0 CVE-2026-36805

Attacker must be able to reach the Tenda G0 web management interface over HTTP and submit a request to the Saveqqlist handler with attacker-controlled qqStr or markStr parameters; CVSS PR:N and UI:N indicate no authentication or user interaction is required against firmware v15.11.0.5. Realistic exploitation is limited to deployments where the management UI is reachable from the attacker's network position - by default Tenda routers expose the UI only on the LAN, so internet-borne exploitation requires that an administrator has enabled remote/WAN management or port-forwarded the admin interface. Other limits: only firmware v15.11.0.5 is confirmed affected by the description, and impact is restricted to denial of service (no confirmed code execution).

Signals point in opposite directions and require careful weighing. The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H describes a fully remote, unauthenticated, low-complexity attack with high availability impact but no confidentiality or integrity loss - consistent with a pure DoS. EPSS of 0.01% (2nd percentile) and no public exploit identified at time of analysis suggest exploitation activity is currently negligible, and the CVE is not on CISA KEV. The CWE-121 classification and description language only claim DoS, not code execution, even though stack overflows on embedded MIPS/ARM devices can sometimes be escalated; absent a working PoC demonstrating control of EIP/PC, this should be treated as the vendor states. The CPE field is a generic 'n/a:n/a' placeholder, which limits automated asset matching and is a data-quality gap defenders should be aware of. Net assessment: medium real-world priority for organizations that expose Tenda G0 management to untrusted networks, low priority where management is restricted to a LAN segment.

An attacker on the same network as a Tenda G0 router - or on the internet if the web UI is WAN-exposed - sends a single crafted HTTP POST to the Saveqqlist endpoint with an overlong qqStr or markStr value. The oversized parameter overflows the fixed stack buffer, crashing the embedded httpd process and knocking the router (and the network behind it) offline until it reboots or is manually power-cycled. No public exploit identified at time of analysis, but the bug class is trivial to reproduce once the endpoint and parameter names are known, both of which are disclosed in this CVE.