CVE-2026-19792
Received Received - Intake

Buffer Overflow in Tenda G0 HTTPD Web Interface

Publication date: 2026-08-14

Last updated on: 2026-08-14

Assigner: VulDB

Description
A security flaw has been discovered in Tenda G0 up to 20260625. Impacted is the function setPortMapping of the file /goform/module of the component httpd web management interface. Performing a manipulation of the argument portMappingServer/porMappingtInternal/portMappingExternal results in buffer overflow. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-14
Last Modified
2026-08-14
Generated
2026-08-14
AI Q&A
2026-08-14
EPSS Evaluated
N/A
NVD
CVE-2026-19792
EUVD
EUVD-2026-58585

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
tenda g0 to 20260625 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-120 The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer.
CWE-119 The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a buffer overflow flaw in the Tenda G0 router's HTTPD web management interface. It exists in the setPortMapping function which processes port mapping operations. Attackers can exploit it by sending overly long strings to the portMappingServer, porMappingtInternal, or portMappingExternal parameters. These inputs are written to a fixed 256-byte stack buffer without proper length checks, allowing overflow that could lead to arbitrary code execution or system crashes.

Detection Guidance

To detect this vulnerability, check if your Tenda G0 router is running firmware up to 20260625. Inspect the HTTPD web management interface for the setPortMapping function in /goform/module. Look for unusual activity in port mapping operations or crashes during add/edit requests.

Impact Analysis

If exploited, this vulnerability could allow remote attackers to execute arbitrary code on your router or cause denial of service. This might give attackers control over your network traffic, expose sensitive data, or disrupt internet connectivity. Since the exploit is publicly available, unpatched systems are at immediate risk of attack.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by enabling unauthorized access to sensitive data or system disruption. A buffer overflow in the Tenda G0 router's HTTPD service may allow attackers to execute arbitrary code or cause denial of service, which could lead to unauthorized data exposure or system unavailability. Such incidents may violate data protection requirements under GDPR (e.g., integrity and confidentiality) and HIPAA (e.g., availability and security of protected health information).

Mitigation Strategies

Immediately update the Tenda G0 router firmware to a version released after 20260625. Disable remote access to the HTTPD web management interface if not required. Monitor network traffic for suspicious port mapping requests.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-19792. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart