CVE-2026-19792: Tenda G0 httpd web management interface module setPortMapping buffer overflow

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-08-14 · updated 2026-08-14
Weakness: CWE-119

Description

A security flaw has been discovered in Tenda G0 up to 20260625. Impacted is the function setPortMapping of the file /goform/module of the component httpd web management interface. Performing a manipulation of the argument portMappingServer/porMappingtInternal/portMappingExternal results in buffer overflow. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks.

Affected products

Tenda G0: 20260625

References

https://github.com/lipenghai/iot_bug/blob/main/Tenda/G0/3.md
https://vuldb.com/cve/CVE-2026-19792
https://vuldb.com/submit/868929
https://vuldb.com/vuln/389758
https://vuldb.com/vuln/389758/cti
https://www.tenda.com.cn/

Get alerted when CVE-2026-19792 or the next vulnerability affects your stack