CVE-2026-19790
Received Received - Intake

Stack-Based Buffer Overflow in Tenda G0 HTTPd Web Interface

Publication date: 2026-08-14

Last updated on: 2026-08-14

Assigner: VulDB

Description
A vulnerability was identified in Tenda G0 up to 20260625. This issue affects the function formSetPortMirror of the file /goform/module of the component httpd Web Management Interface. Such manipulation of the argument portMirrorMirroredPorts leads to stack-based buffer overflow. The attack can be executed remotely. The exploit is publicly available and might be used.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-14
Last Modified
2026-08-14
Generated
2026-08-14
AI Q&A
2026-08-14
EPSS Evaluated
N/A
NVD
CVE-2026-19790
EUVD
EUVD-2026-58575

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
tenda g0 to 20260625 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-121 A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).
CWE-119 The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a stack-based buffer overflow in the Tenda G0 router's web management interface. It occurs in the formSetPortMirror function when handling the portMirrorMirroredPorts argument. The issue arises because the function uses sprintf to write user input into a fixed-size buffer without checking the input length, allowing attackers to overflow the buffer with specially crafted data.

Detection Guidance

To detect this vulnerability, check if your Tenda G0 router is running firmware up to 20260625. Inspect network traffic for HTTP requests targeting /goform/module with the formSetPortMirror function and the portMirrorMirroredPorts parameter. Look for unusually long values in this parameter which may indicate exploitation attempts.

Impact Analysis

This vulnerability can be exploited remotely to execute arbitrary code or cause a denial of service on the affected Tenda G0 router. Attackers could gain control of the device, steal sensitive information, or disrupt network operations. The public availability of an exploit increases the risk of real-world attacks.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by enabling unauthorized access to sensitive data or system disruption. A remote attacker could exploit the stack-based buffer overflow to execute arbitrary code or cause denial of service, which may lead to data breaches or loss of system integrity. Such incidents could violate confidentiality requirements under GDPR and compromise protected health information under HIPAA.

Mitigation Strategies

Immediately update the Tenda G0 router to the latest firmware version beyond 20260625. Disable remote access to the HTTP Web Management Interface if not required. Monitor network traffic for suspicious activity targeting the /goform/module endpoint. Consider isolating the device from critical network segments until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-19790. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart