CVE-2026-36800: Tenda G0 Router DoS Vulnerability

CVE-2026-36800 Overview

CVE-2026-36800 is a buffer overflow vulnerability in Shenzhen Tenda Technology Co., Ltd Tenda G0 router firmware version v15.11.0.5. The flaw exists in the formIPMacBindDel function and is triggered through the IPMacBindIndex parameter. Remote attackers can send a crafted HTTP request to overflow the buffer and cause a Denial of Service (DoS) condition on the affected device. The vulnerability requires no authentication and no user interaction, making it reachable by any attacker with network access to the router's management interface. It is classified under [CWE-120] (Buffer Copy without Checking Size of Input).

Critical Impact
Unauthenticated remote attackers can crash the Tenda G0 router via a single crafted HTTP request, disrupting network connectivity for all downstream users.

Affected Products

Shenzhen Tenda Technology Co., Ltd Tenda G0
Firmware version v15.11.0.5
formIPMacBindDel function handling the IPMacBindIndex HTTP parameter

Discovery Timeline

2026-06-09 - CVE-2026-36800 published to NVD
2026-06-10 - Last updated in NVD database

Technical Details for CVE-2026-36800

Vulnerability Analysis

The vulnerability resides in the formIPMacBindDel function within the Tenda G0 web management interface. This function processes HTTP requests related to deleting IP/MAC binding entries on the router. When the function reads the IPMacBindIndex parameter from the incoming request, it copies the attacker-controlled value into a fixed-size stack buffer without validating its length. An oversized input overruns the destination buffer and corrupts adjacent memory, including saved return addresses and control-flow data on the stack. The resulting memory corruption causes the httpd process to crash, terminating the management interface and disrupting router operations.

Root Cause

The root cause is missing bounds checking on user-supplied input. The formIPMacBindDel handler relies on unsafe string copy operations rather than length-bounded functions such as strncpy or snprintf. Because the IPMacBindIndex parameter is treated as trusted input, the implementation does not enforce a maximum length before copying it into the local buffer.

Attack Vector

The attack is delivered over the network through a single crafted HTTP request to the router's web interface. No credentials or user interaction are required. An attacker on the local network, or on the internet if the management interface is exposed, sends a POST request to the formIPMacBindDel endpoint with an excessively long IPMacBindIndex value. The router's httpd process crashes, denying service to legitimate administrators and downstream clients relying on the router for connectivity. Technical details and a proof-of-concept are available in the GitHub PoC Repository.

Detection Methods for CVE-2026-36800

Indicators of Compromise

Unexpected reboots or crashes of the Tenda G0 router or its httpd process
HTTP POST requests to endpoints invoking formIPMacBindDel with abnormally long IPMacBindIndex parameter values
Loss of management interface availability following inbound HTTP traffic from untrusted sources
Repeated short-interval requests targeting the IP/MAC binding management functions

Detection Strategies

Inspect HTTP request bodies destined for the router's management interface and flag IPMacBindIndex values exceeding expected length thresholds
Deploy network IDS/IPS signatures that match oversized parameter values in requests to Tenda formIPMacBind* endpoints
Correlate router availability loss with preceding HTTP traffic patterns to identify exploitation attempts

Monitoring Recommendations

Continuously monitor router uptime and httpd process health using SNMP or syslog telemetry
Log all administrative HTTP requests to the router and alert on requests originating from non-management subnets
Track repeated DoS-style restarts as a precursor to broader network disruption attempts

How to Mitigate CVE-2026-36800

Immediate Actions Required

Restrict access to the Tenda G0 web management interface to trusted management VLANs or specific administrative IP addresses
Disable remote (WAN-side) administration unless explicitly required for operations
Isolate affected devices behind a firewall that blocks unsolicited inbound HTTP traffic to the router

Patch Information

No vendor advisory or official patch has been published for CVE-2026-36800 at the time of NVD publication. Administrators should monitor Shenzhen Tenda Technology Co., Ltd communications for firmware updates addressing the formIPMacBindDel buffer overflow and apply them as soon as they become available.

Workarounds

Place the router's management interface on an isolated administrative network segment unreachable from untrusted clients
Enforce ACLs on upstream network equipment to drop HTTP requests to the router from non-administrative sources
Consider replacing the affected device with a supported model if a vendor patch is not released in a timely manner

bash

# Configuration example: restrict access to router management interface
# Example iptables rule on an upstream gateway permitting only the admin subnet
iptables -A FORWARD -p tcp -d <router_ip> --dport 80 -s 192.0.2.0/24 -j ACCEPT
iptables -A FORWARD -p tcp -d <router_ip> --dport 80 -j DROP