CVE-2026-36805 Overview
CVE-2026-36805 is a stack-based buffer overflow vulnerability [CWE-121] affecting Shenzhen Tenda Technology Co., Ltd Tenda G0 routers running firmware version v15.11.0.5. The flaw resides in the Saveqqlist function, which improperly handles the qqStr and markStr parameters. Remote attackers can send a crafted HTTP request to trigger the overflow and cause a Denial of Service (DoS) condition on the device. Exploitation requires no authentication or user interaction and can be performed over the network.
Critical Impact
Unauthenticated remote attackers can crash the router via crafted HTTP requests, disrupting network availability for all connected users.
Affected Products
- Shenzhen Tenda Technology Co., Ltd Tenda G0
- Firmware version v15.11.0.5
- Devices exposing the affected web management interface
Discovery Timeline
- 2026-06-09 - CVE-2026-36805 published to NVD
- 2026-06-10 - Last updated in NVD database
Technical Details for CVE-2026-36805
Vulnerability Analysis
The vulnerability is a stack-based buffer overflow in the Saveqqlist function of the Tenda G0 router's web management interface. The function processes HTTP request parameters qqStr and markStr without enforcing proper length validation before copying them into fixed-size stack buffers. An attacker submitting overly long values for either parameter overwrites adjacent stack memory, including saved return addresses, which causes the HTTP service to crash.
The vulnerability class [CWE-121] is well-understood in embedded router firmware, where lightweight HTTP handlers often rely on unsafe string operations such as strcpy or sprintf without bounds checking. The current public impact is limited to Denial of Service, though stack corruption flaws of this type frequently warrant further analysis for code execution potential on MIPS or ARM-based router architectures.
Root Cause
The root cause is missing input length validation on the qqStr and markStr HTTP parameters before they are copied into stack-allocated buffers within the Saveqqlist handler. The firmware does not enforce maximum input sizes at the parser layer, allowing attacker-controlled data to exceed buffer boundaries and corrupt adjacent stack state.
Attack Vector
The attack vector is network-based and requires no authentication. An attacker on the same network as the device, or with reachable access to the router's web management interface, sends a crafted HTTP POST request containing oversized qqStr or markStr values to the endpoint handled by Saveqqlist. The resulting buffer overflow crashes the HTTPD process and disrupts router functionality. Technical details and a proof-of-concept are documented in the GitHub PoC Repository.
Detection Methods for CVE-2026-36805
Indicators of Compromise
- Unexpected reboots or crashes of the Tenda G0 router HTTPD process
- HTTP POST requests targeting the Saveqqlist endpoint with abnormally long qqStr or markStr parameter values
- Loss of management interface availability following inbound HTTP traffic from untrusted sources
Detection Strategies
- Inspect HTTP request payloads destined for the router management interface and flag requests where qqStr or markStr parameters exceed expected lengths
- Monitor router availability and uptime metrics for unexplained service restarts correlated with inbound HTTP traffic
- Deploy network intrusion detection signatures matching crafted POST requests to the Saveqqlist handler
Monitoring Recommendations
- Log all HTTP requests reaching the router's web management interface, including source IP and parameter sizes
- Alert on repeated HTTPD process crashes or router reboots within a short time window
- Restrict and monitor network segments where management interfaces are reachable from untrusted hosts
How to Mitigate CVE-2026-36805
Immediate Actions Required
- Restrict access to the Tenda G0 web management interface to trusted administrative networks only
- Disable remote WAN-side management on affected devices if not strictly required
- Place affected routers behind network filtering that blocks untrusted HTTP traffic to the management port
Patch Information
No vendor patch has been referenced in the published CVE data at this time. Administrators should monitor Shenzhen Tenda Technology Co., Ltd advisories for firmware updates addressing the Saveqqlist buffer overflow in Tenda G0 firmware v15.11.0.5. Replacement with non-affected hardware should be considered if the vendor does not release a fix.
Workarounds
- Apply ACLs on upstream network devices to block HTTP and HTTPS traffic to the router management interface from untrusted sources
- Segment the router management VLAN away from general user and guest networks
- Disable any unused services on the router to reduce the exposed attack surface
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
