Description

A security flaw has been discovered in Tenda G0 up to 20260625. Impacted is the function setPortMapping of the file /goform/module of the component httpd web management interface. Performing a manipulation of the argument portMappingServer/porMappingtInternal/portMappingExternal results in buffer overflow. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-14T05:16:59.030Z",
  "pubdate": "2026-08-14T05:16:59.030Z",
  "executiveSummary": "A critical security flaw has been identified in the httpd web management interface of Tenda G0 devices up to version 20260625. The vulnerability resides within the setPortMapping function located in the /goform/module file, specifically stemming from unsafe handling of input parameters. This vulnerability is classified as a buffer overflow, which occurs when input data exceeds the allocated memory boundaries of a buffer, leading to memory corruption. The flaw allows remote attackers to execute arbitrary code, manipulate system execution flow, or cause a denial of service condition against the affected network device. The attack vector is fully remote, meaning exploitation does not require physical access to the target hardware, significantly elevating the associated risk profile. Public exploits targeting this specific flaw have already been released, increasing the likelihood of active exploitation in the wild. Organizations utilizing vulnerable Tenda G0 firmware versions face immediate exposure to remote code execution and potential device compromise if external network interfaces are exposed.",
  "technicalDetails": "The vulnerability is a classic stack-based or heap-based buffer overflow within the httpd web management interface of Tenda G0 devices running firmware versions up to 20260625. The root cause lies in the setPortMapping function, implemented within the /goform/module binary, which fails to adequately validate or sanitize the length of user-supplied input parameters before copying them into memory buffers.\nSpecifically, the flaw can be triggered by manipulating the arguments portMappingServer, porMappingtInternal, or portMappingExternal during an HTTP request to the vulnerable endpoint. When excessively long strings are supplied to these parameters, the underlying C-style string handling functions copy the data into a fixed-size buffer without performing adequate bounds checking. This results in an overflow of the designated memory space, overwriting adjacent memory structures, such as saved frame pointers and return addresses.\nThe attack flow requires an attacker with network access to the httpd web management interface. Because the vulnerability is accessible remotely via the network protocol, an unauthenticated or authenticated attacker (depending on the interface access controls) can craft a malicious HTTP request containing an oversized payload targeted at the portMappingServer, porMappingtInternal, or portMappingExternal parameters.\nUpon receiving the malicious request, the setPortMapping function processes the parameters and writes the oversized input to the vulnerable memory buffer. The resulting memory corruption allows the attacker to hijack the instruction pointer (PC) upon function return, enabling the execution of arbitrary shellcode or Return-Oriented Programming (ROP) chains. Post-exploitation impact includes full system compromise, persistent backdoor installation, unauthorized network configuration changes, and complete loss of device integrity."
}