Executive Summary

The CVE-2026-36798 vulnerability affects Tenda G0 routers running version V15.11.0.5. It involves improper handling of user-controlled HTTP parameters named enable, level, and module in the formPortalAuth function. These parameters are retrieved and then used unsafely in a command constructed with sprintf and executed via system(), which allows an attacker to execute arbitrary code on the device.

An attacker can exploit this vulnerability by sending a specially crafted HTTP request to the formPortalAuth CGI endpoint with malicious values for these parameters, potentially causing denial of service or arbitrary code execution.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you by allowing an attacker to cause a denial of service (DoS) on your Tenda G0 router, leading to process crashes or device instability.

More severely, it can allow arbitrary code execution, meaning an attacker could run malicious commands on your device, potentially taking control of it or using it as a foothold for further attacks.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by monitoring for suspicious HTTP requests sent to the `formPortalAuth` CGI endpoint on Tenda G0 routers running version V15.11.0.5. Specifically, look for HTTP requests containing the parameters `enable`, `level`, or `module` with unusual or malicious values such as command injection patterns (e.g., values containing shell commands like `1;telnet 127.0.0.1 80;`).

You can use network monitoring tools or command-line utilities like curl or tcpdump to detect such requests. For example, using curl to test the endpoint with suspicious parameters:

• curl -v "http://<router-ip>/formPortalAuth?enable=1;telnet 127.0.0.1 80;"
• tcpdump -i <interface> -A 'tcp port 80 and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)' | grep 'formPortalAuth'

Additionally, inspecting router logs for crashes or instability around the time of such requests can help identify exploitation attempts.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include restricting access to the vulnerable `formPortalAuth` CGI endpoint by limiting HTTP access to trusted networks or IP addresses.

Disable remote management features on the Tenda G0 router if not required, to reduce exposure.

Monitor and block suspicious HTTP requests containing suspicious parameters such as `enable`, `level`, or `module` with unusual values.

If available, update the router firmware to a version that patches this vulnerability.

Useful 0 Not Useful 0