CVE-2026-36801: Tenda G0 Router Buffer Overflow DoS Flaw

CVE-2026-36801 Overview

CVE-2026-36801 is a buffer overflow vulnerability in Shenzhen Tenda Technology Co., Ltd Tenda G0 router firmware version v15.11.0.5. The flaw resides in the IPMacBindRule parameter handling within the formIPMacBindAdd function. Remote attackers can trigger the overflow by sending a crafted HTTP request to the device, causing a Denial of Service (DoS) condition. The vulnerability is classified under [CWE-120] Buffer Copy without Checking Size of Input, indicating insufficient bounds validation on user-supplied input. No authentication or user interaction is required for exploitation.

Critical Impact
Unauthenticated remote attackers can crash the Tenda G0 router via a single crafted HTTP request, disrupting network availability for connected clients.

Affected Products

Shenzhen Tenda Technology Co., Ltd Tenda G0
Firmware version v15.11.0.5
formIPMacBindAdd function handling the IPMacBindRule parameter

Discovery Timeline

2026-06-09 - CVE-2026-36801 published to NVD
2026-06-10 - Last updated in NVD database

Technical Details for CVE-2026-36801

Vulnerability Analysis

The vulnerability exists in the formIPMacBindAdd function, which handles IP-MAC binding rule configuration requests on the Tenda G0 router web management interface. The function processes the IPMacBindRule HTTP parameter without validating its length before copying it into a fixed-size stack buffer. An attacker sending an oversized value for this parameter overwrites adjacent stack memory, corrupting the program state.

The corruption causes the HTTP service or the device itself to crash, producing a Denial of Service condition. Because the flaw is reachable over the network without authentication or user interaction, the attack complexity is low. The published EPSS score of 0.254% places the immediate exploitation probability in the lower range, but unauthenticated network reachability raises practical risk where the management interface is exposed.

Root Cause

The root cause is missing input length validation on the IPMacBindRule parameter inside formIPMacBindAdd. The function performs an unchecked copy of attacker-controlled HTTP data into a stack buffer of fixed size, a classic [CWE-120] pattern common in embedded MIPS-based router firmware written in C.

Attack Vector

The attack vector is network-based. An attacker crafts an HTTP request to the router's web management endpoint and supplies an overlong IPMacBindRule parameter value. When the affected handler processes the request, the stack buffer overflows and the device crashes. Technical details and proof-of-concept material are published in the GitHub PoC Repository.

No verified exploit code is reproduced here. Refer to the linked PoC repository for the request structure and parameter payload used to trigger the overflow.

Detection Methods for CVE-2026-36801

Indicators of Compromise

Unexpected reboots or web management service crashes on Tenda G0 routers running firmware v15.11.0.5.
Inbound HTTP POST requests to router management endpoints containing abnormally long IPMacBindRule parameter values.
Loss of connectivity for clients behind the router coinciding with HTTP traffic to its management interface.

Detection Strategies

Inspect HTTP traffic destined for Tenda G0 management interfaces and flag requests where the IPMacBindRule parameter exceeds expected length thresholds.
Correlate router availability loss with preceding HTTP requests to formIPMacBindAdd to identify exploitation attempts.
Deploy network-based intrusion detection signatures targeting oversized parameter values in form submissions to the router's web admin path.

Monitoring Recommendations

Forward router syslog and uptime telemetry to a centralized log platform and alert on repeated unscheduled restarts.
Monitor WAN-side exposure of the router management interface and alert on any inbound TCP connections to its HTTP/HTTPS admin ports.
Track HTTP request size and parameter length distributions on management traffic to establish a baseline and detect anomalies.

How to Mitigate CVE-2026-36801

Immediate Actions Required

Restrict access to the Tenda G0 web management interface to trusted LAN segments and block WAN-side exposure.
Disable remote management features on affected devices until a vendor patch is available.
Apply network-level filtering to drop HTTP requests containing oversized IPMacBindRule parameter values.

Patch Information

No vendor patch is referenced in the available CVE data at the time of publication. Monitor Shenzhen Tenda Technology Co., Ltd advisories for firmware updates beyond v15.11.0.5 that address the formIPMacBindAdd input validation flaw.

Workarounds

Place affected routers behind a perimeter firewall and allow management access only from explicitly trusted internal hosts.
Use access control lists to limit which source addresses can reach the router's HTTP management port.
Where feasible, replace affected devices with models receiving active vendor security maintenance.

bash

# Example: restrict router management interface access at the network layer
# Block inbound HTTP/HTTPS to the router management IP from untrusted networks
iptables -A FORWARD -d <router_mgmt_ip> -p tcp --dport 80 -j DROP
iptables -A FORWARD -d <router_mgmt_ip> -p tcp --dport 443 -j DROP

# Allow only a trusted admin subnet
iptables -I FORWARD -s 10.0.0.0/24 -d <router_mgmt_ip> -p tcp --dport 80 -j ACCEPT