Which versions of Tenda G0 are affected by EUVD-2026-58585?

Tenda G0 router models up to firmware version 20260625 contain a remote code execution vulnerability in the web management interface that can be exploited by authenticated users to compromise network…

Is there a public PoC exploit available for EUVD-2026-58585?

Yes, a public proof-of-concept exploit is available for EUVD-2026-58585. Prioritise patching immediately. EPSS: 0.5%.

How to fix or mitigate EUVD-2026-58585?

Within 24 hours, conduct a complete inventory of Tenda G0 routers with firmware versions through 20260625 and immediately restrict administrative access to these devices to trusted internal networks only, disabling remote management capability if operationally feasible; enable comprehensive audit logging on the /goform/module endpoint and all authentication attempts. Within 7 days, evaluate replacement networking equipment from vendors with current security patch records and establish a hardware transition timeline, prioritizing routers that manage traffic to critical systems or sensitive data. Within 30 days, complete migration of affected equipment to patched alternatives or implement strict network segmentation controls that isolate these routers from systems containing confidential information or critical business functions.

Tenda G0 EUVD-2026-58585

Q: What is the CVSS score of EUVD-2026-58585?

EUVD-2026-58585 has a CVSS 4.0 base score of 7.4 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.5%.

| CVE-2026-19792 HIGH

Classic Buffer Overflow (CWE-120)

2026-08-14 VulDB

GHSA-w66q-5x8w-9jjm

Buffer Overflow Tenda G0

7.4

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

7.4 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.8 HIGH

Management interface is network-reachable (AV:N), low credentials sufficient (PR:L), no scope change, full C/I/A impact on device consistent with RCE or crash.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Aug 14, 2026 - 05:29 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Aug 14, 2026 - 05:22 vuln.today

cvss_changed

CVSS changed

Aug 14, 2026 - 05:22 NVD

8.7 (HIGH) 7.4 (HIGH)

Analysis Generated

Aug 14, 2026 - 04:45 vuln.today

CVE Published

Aug 14, 2026 - 04:00 cve.org

HIGH 8.7

DescriptionCVE.org

A security flaw has been discovered in Tenda G0 up to 20260625. Impacted is the function setPortMapping of the file /goform/module of the component httpd web management interface. Performing a manipulation of the argument portMappingServer/porMappingtInternal/portMappingExternal results in buffer overflow. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks.

AnalysisAI

Buffer overflow in the Tenda G0 router's httpd web management interface allows authenticated remote attackers to corrupt memory and potentially execute arbitrary code by submitting oversized input to the setPortMapping function via the /goform/module endpoint. All firmware builds up to version 20260625 are confirmed affected per ENISA EUVD-2026-58585. A public proof-of-concept exploit has been released on GitHub, substantially lowering the skill threshold for exploitation; no CISA KEV listing confirming active mass exploitation was present at time of analysis.

Technical ContextAI

The Tenda G0 is a SOHO/home routing device whose firmware ships an httpd-based web management interface. The vulnerable function setPortMapping accepts port mapping configuration parameters - portMappingServer, porMappingtInternal, and portMappingExternal - via HTTP POST requests to /goform/module and copies attacker-controlled input into a fixed-size buffer without validating the input length against the buffer boundary. This is a textbook CWE-120 (Buffer Copy without Checking Size of Input - Classic Buffer Overflow) defect: the absence of bounds checking allows a sufficiently long argument to overwrite adjacent stack or heap memory. The CPE identifier cpe:2.3:a:tenda:g0:*:*:*:*:*:*:*:* covers all firmware sub-versions with no lower bound exclusion. The CVSS 4.0 E:P (exploit public) modifier confirms that functional exploit code has been publicly released, corroborated by the GitHub PoC reference from researcher lipenghai.

RemediationAI

No vendor-released patch with a confirmed fixed firmware version has been identified in the available references at time of analysis; administrators should monitor https://www.tenda.com.cn/ and the VulDB advisory at https://vuldb.com/vuln/389758 for firmware updates addressing CVE-2026-19792. As an immediate compensating control, disable the web management interface on WAN-facing interfaces if remote management is not operationally required - this eliminates network-based exploitation for most deployment scenarios without affecting routing functionality. Where management access must be retained, apply firewall ACLs to restrict access to the management port exclusively to trusted administrative IP addresses, reducing exposure to the PR:L attack vector. Placing the Tenda G0 behind a network segment that does not expose the management port to untrusted hosts further constrains the exploitable attack surface. Device replacement with a product under active security support should be considered if a vendor patch is not released within a reasonable timeframe, given the public PoC availability.