Description

A weakness has been identified in Tenda G0 up to 20260625. The affected element is the function addStaticRoute of the file /goform/module of the component httpd web management interface. Executing a manipulation of the argument staticRouteNet can lead to stack-based buffer overflow. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-14T05:16:58.857Z",
  "pubdate": "2026-08-14T05:16:58.857Z",
  "executiveSummary": "A critical stack-based buffer overflow vulnerability has been identified within the httpd web management interface of Tenda G0 devices up to version 20260625. This security defect resides in the addStaticRoute function processed via the /goform/module endpoint. Specifically, improper handling of the staticRouteNet argument allows malicious actors to supply oversized input that exceeds the allocated stack buffer boundaries. Successful exploitation of this vulnerability permits remote attackers to execute arbitrary code, potentially leading to complete compromise of the affected routing device. The attack vector is fully network-accessible, and public availability of functional exploit material significantly increases operational risk. Because the affected component handles administrative routing configurations, unauthorized control can facilitate lateral movement, interception of network traffic, or persistent device manipulation. Remediation is complicated by the lack of official patches in the baseline description, necessitating strict perimeter defenses and administrative access restrictions to mitigate the attack surface.",
  "technicalDetails": "The vulnerability is a classic stack-based buffer overflow stemming from unsafe memory handling routines within the embedded httpd web management daemon of Tenda G0 firmware up to version 20260625. The root cause lies in the addStaticRoute function, which processes incoming HTTP POST or GET parameters sent to the /goform/module URI. During the parsing of user-supplied parameters, the function specifically reads the staticRouteNet argument into a fixed-size stack buffer without performing adequate bounds checking or length validation.\nWhen a remote attacker transmits an HTTP request containing a craftily constructed, excessively long string within the staticRouteNet parameter, the underlying memory copy operation writes past the allocated boundaries of the stack variable. This action overwrites adjacent stack memory, including critical execution context such as the saved frame pointer and the return address. Upon completion of the vulnerable function, the processor attempts to return execution to the overwritten address, allowing the attacker to redirect the instruction pointer to shellcode injected via the payload or to utilize return-oriented programming (ROP) chains.\nExecution of this attack occurs remotely over the network without requiring prior authentication or specific user interaction, provided the management interface is exposed. The network exposure of the httpd service means any entity capable of reaching the device's web interface can initiate the exploitation sequence. Post-exploitation impact includes arbitrary code execution with the high privileges typically associated with the httpd daemon, which often runs as root on embedded consumer and small-office routing hardware. This grants the adversary comprehensive control over the operating system, enabling the installation of persistent backdoors, modification of firewall and routing rules, or deployment in broader botnet infrastructures."
}