CVE-2026-36799 Overview
CVE-2026-36799 is a buffer overflow vulnerability in the Tenda G0 router running firmware version v15.11.0.5. The flaw resides in the formPortalAuth function, where the portalAuth parameter is processed without proper bounds checking. A remote, unauthenticated attacker can submit a crafted HTTP request to trigger the overflow and cause a Denial of Service (DoS) condition on the device. The vulnerability is classified under [CWE-120] (Buffer Copy without Checking Size of Input). Exploitation requires no privileges and no user interaction, making the affected device reachable from any attacker with network access to its management interface.
Critical Impact
A single crafted HTTP request to the formPortalAuth endpoint can crash the Tenda G0 router, disrupting all network services routed through the device.
Affected Products
- Shenzhen Tenda Technology Co., Ltd Tenda G0
- Firmware version v15.11.0.5
- Devices exposing the captive portal authentication interface (formPortalAuth)
Discovery Timeline
- 2026-06-09 - CVE-2026-36799 published to NVD
- 2026-06-10 - Last updated in NVD database
Technical Details for CVE-2026-36799
Vulnerability Analysis
The vulnerability exists in the formPortalAuth handler of the Tenda G0 router's web management interface. This handler is responsible for processing captive portal authentication requests sent over HTTP. When the router receives a request containing the portalAuth parameter, the handler copies the attacker-supplied value into a fixed-size stack buffer without validating the input length.
An attacker who sends an oversized portalAuth value overflows the destination buffer. The overflow corrupts adjacent stack memory, including the saved return address, which causes the httpd process to crash. Because httpd also manages routing-related services on the device, the crash interrupts network connectivity for clients behind the router.
The attack vector is network-based, requires no authentication, and no user interaction. The impact is limited to availability — confidentiality and integrity are not affected. The current EPSS probability is 0.254% (48.99 percentile).
Root Cause
The root cause is the absence of length validation on the portalAuth query parameter before it is copied into a fixed-size buffer. The function relies on an unbounded copy operation, a classic [CWE-120] pattern common in embedded Linux router firmware compiled from C source.
Attack Vector
An attacker sends a single HTTP request to the router's web interface. The request targets the captive portal authentication endpoint and supplies a portalAuth parameter whose length exceeds the destination buffer. The malformed request triggers the overflow and crashes the service. Public proof-of-concept material is available in the GitHub PoC Repository. No verified exploit code is reproduced here; the vulnerability mechanism is described in prose as the PoC is hosted externally.
Detection Methods for CVE-2026-36799
Indicators of Compromise
- HTTP requests targeting the formPortalAuth endpoint with abnormally long portalAuth parameter values
- Repeated reboots or service restarts of the Tenda G0 router httpd process
- Loss of management interface availability following inbound HTTP traffic from untrusted sources
Detection Strategies
- Inspect inbound HTTP traffic to router management interfaces for portalAuth parameter values exceeding expected length (typically a few hundred bytes)
- Correlate router availability loss events with preceding HTTP POST or GET requests to formPortalAuth
- Deploy network IDS signatures that flag oversized query parameters directed at known Tenda management endpoints
Monitoring Recommendations
- Forward router syslog data to a centralized logging platform and alert on repeated httpd crashes or watchdog reboots
- Monitor SNMP or ICMP availability of the device with sub-minute polling to detect DoS events quickly
- Track source IP addresses that issue authentication requests to the captive portal and rate-limit anomalous senders
How to Mitigate CVE-2026-36799
Immediate Actions Required
- Restrict access to the Tenda G0 web management interface so it is reachable only from trusted internal networks
- Disable remote WAN-side administration on affected routers until a vendor fix is applied
- Place a reverse proxy or web application firewall in front of the management interface to enforce parameter length limits
Patch Information
No vendor patch is referenced in the NVD entry at the time of publication. Administrators should monitor Shenzhen Tenda Technology Co., Ltd advisories for an updated firmware release that supersedes v15.11.0.5. Until a fixed firmware version is published, mitigations must be applied at the network layer.
Workarounds
- Block external access to TCP ports used by the router's HTTP management interface at the upstream firewall
- Filter inbound HTTP requests that contain portalAuth parameter values longer than the legitimate maximum length
- Segment the router management VLAN from general user traffic to reduce the attack surface
- Replace end-of-life Tenda G0 devices with currently supported hardware if no firmware update becomes available
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
