Description

A vulnerability was identified in Tenda G0 up to 20260625. This issue affects the function formSetPortMirror of the file /goform/module of the component httpd Web Management Interface. Such manipulation of the argument portMirrorMirroredPorts leads to stack-based buffer overflow. The attack can be executed remotely. The exploit is publicly available and might be used.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-14T04:16:40.780Z",
  "pubdate": "2026-08-14T04:16:40.780Z",
  "executiveSummary": "A stack-based buffer overflow vulnerability has been identified within the httpd Web Management Interface of Tenda G0 devices up to 20260625. The security defect resides in the function formSetPortMirror processing the /goform/module endpoint. Specifically, improper handling of the argument portMirrorMirroredPorts allows an unauthenticated remote attacker to trigger memory corruption via crafted HTTP requests.\nThe vulnerability carries critical risk implications, potentially enabling remote code execution or complete denial of service of the affected routing and networking hardware. Exploitation requires network connectivity to the management interface, and public availability of exploit material significantly elevates the likelihood of active targeting.\nImpacted systems include Tenda G0 router variants running firmware versions up to 20260625. Immediate remediation is complicated by the lack of official vendor patch details in the current advisory, necessitating strict boundary defense and administrative access controls.",
  "technicalDetails": "The vulnerability is a classic stack-based buffer overflow stemming from unsafe memory copy operations within the httpd Web Management Interface of Tenda G0. The vulnerable component is the function formSetPortMirror located within the binary handling requests to the /goform/module endpoint.\nDuring execution, the function parses incoming HTTP POST or GET parameters to configure port mirroring settings. Specifically, the argument portMirrorMirroredPorts is read and processed without proper bounds checking or input validation on its length before being written to a fixed-size stack buffer.\nWhen an attacker supplies an excessively long string via the portMirrorMirroredPorts parameter, the input exceeds the allocated buffer bounds on the stack. This results in the overwriting of adjacent stack memory, including saved frame pointers and return addresses.\nThe attack flow proceeds as follows: First, the remote adversary establishes network connectivity to the HTTP-based management service running on the target Tenda G0 device. Second, the attacker crafts a malicious HTTP request targeting the /goform/module URI, injecting a specially crafted payload into the portMirrorMirroredPorts parameter. Third, the httpd daemon passes the oversized input to the formSetPortMirror function, where the unbounded copy operation executes.\nUpon processing, the injected payload overwrites the stack control data. When the function attempts to return execution control to its caller, the instruction pointer is redirected to attacker-controlled memory if a return-oriented programming (ROP) chain or shellcode is successfully placed and executed.\nThe vulnerability can be executed remotely over the network without requiring prior authentication or privileged access, assuming the management interface is exposed to the attack surface. Post-exploitation impact includes full system compromise, persistent unauthorized access, firmware tampering, or persistent denial of service through repeated application crashes."
}