CVE-2026-36797 Overview
CVE-2026-36797 is a stack overflow vulnerability in Shenzhen Tenda Technology Co., Ltd Tenda G0 router firmware version v15.11.0.5. The flaw resides in the IPMacBindRuleIp parameter of the formIPMacBindModify function. An unauthenticated attacker can trigger the overflow by sending a crafted HTTP request to the device, causing a Denial of Service (DoS) condition. The vulnerability is classified under CWE-120: Buffer Copy without Checking Size of Input.
Critical Impact
Remote, unauthenticated attackers can crash the Tenda G0 router by issuing a single malformed HTTP request, disrupting network connectivity for all downstream users.
Affected Products
- Shenzhen Tenda Technology Co., Ltd Tenda G0
- Firmware version v15.11.0.5
- Web management interface exposing the formIPMacBindModify handler
Discovery Timeline
- 2026-06-09 - CVE-2026-36797 published to NVD
- 2026-06-10 - Last updated in NVD database
Technical Details for CVE-2026-36797
Vulnerability Analysis
The vulnerability exists in the formIPMacBindModify function within the Tenda G0 web management interface. This function processes HTTP requests used to configure IP-to-MAC binding rules on the router. The handler reads the IPMacBindRuleIp parameter directly from the HTTP request body and copies it into a fixed-size stack buffer without enforcing length validation.
When the attacker supplies an oversized IPMacBindRuleIp value, the copy operation overruns the destination buffer and corrupts adjacent stack memory, including saved return addresses. The resulting memory corruption forces the web server process to terminate. Because the management daemon is responsible for routing-related services on this SOHO device, the crash produces a Denial of Service condition that affects all clients behind the router.
Root Cause
The root cause is missing bounds checking on attacker-controlled input prior to a stack buffer copy [CWE-120]. The formIPMacBindModify function trusts the length of the IPMacBindRuleIp parameter rather than truncating or validating it against the destination buffer size.
Attack Vector
Exploitation requires network access to the router's HTTP management interface. No authentication or user interaction is required. An attacker on the LAN, or on the WAN if remote management is enabled, can submit a single crafted POST request targeting the formIPMacBindModify endpoint with an overlong IPMacBindRuleIp value. A public proof-of-concept is referenced in the GitHub PoC Repository.
Detection Methods for CVE-2026-36797
Indicators of Compromise
- HTTP POST requests to the router management interface targeting formIPMacBindModify containing abnormally long IPMacBindRuleIp parameter values.
- Unexpected reboots or crashes of the Tenda G0 web management daemon.
- Loss of LAN-side routing or DHCP services correlating with inbound HTTP traffic to the device.
Detection Strategies
- Inspect HTTP request bodies destined for the router management IP for parameters exceeding expected length thresholds, particularly IPMacBindRuleIp.
- Correlate router availability monitoring with web traffic flows to identify crash-inducing requests.
- Alert on repeated HTTP 5xx responses or connection resets from the router management interface.
Monitoring Recommendations
- Log all access to the router's HTTP administrative interface and restrict it to a dedicated management VLAN.
- Monitor for inbound HTTP traffic from untrusted networks to any Tenda management endpoint.
- Track router uptime and service availability through SNMP or ICMP probes to identify abrupt restarts.
How to Mitigate CVE-2026-36797
Immediate Actions Required
- Disable remote (WAN-side) HTTP management on affected Tenda G0 devices immediately.
- Restrict LAN access to the router management interface using firewall rules or a dedicated management VLAN.
- Replace or isolate affected devices until a vendor patch is available.
Patch Information
No vendor advisory or patched firmware version has been published in the NVD record at the time of writing. Operators should monitor the Tenda support portal for updated firmware releases addressing the formIPMacBindModify stack overflow.
Workarounds
- Block external access to TCP ports 80 and 443 on the router's WAN interface.
- Place the device behind an upstream firewall that filters HTTP requests containing oversized IPMacBindRuleIp values.
- Limit administrative access to a known set of management workstations via source-IP allowlisting.
# Example: restrict router admin access to a single management host
iptables -A INPUT -p tcp --dport 80 -s 192.0.2.10 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -s 192.0.2.10 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
