CVE-2026-19791 in Tenda
Summary
by MITRE • 08/14/2026
A weakness has been identified in Tenda G0 up to 20260625. The affected element is the function addStaticRoute of the file /goform/module of the component httpd web management interface. Executing a manipulation of the argument staticRouteNet can lead to stack-based buffer overflow. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/14/2026
The vulnerability identified in Tenda G0 firmware version 20260625 represents a critical stack-based buffer overflow weakness that exists within the httpd web management interface component. This issue manifests specifically within the addStaticRoute function located in the /goform/module file, where improper input validation allows attackers to manipulate the staticRouteNet argument. The vulnerability's classification as remote exploitation capability means that malicious actors can trigger this buffer overflow without requiring physical access to the device, making it particularly dangerous for network-connected IoT devices.
The technical flaw stems from insufficient bounds checking when processing user-supplied data through the web interface. When the staticRouteNet parameter is passed to the addStaticRoute function, the application fails to properly validate the input length before copying it into a fixed-size stack buffer. This classic buffer overflow condition occurs because the program does not verify that the incoming data conforms to expected size parameters, allowing an attacker to exceed the allocated buffer space and overwrite adjacent memory locations on the stack. Such overflows can potentially corrupt program execution flow, leading to arbitrary code execution or system crashes.
The operational impact of this vulnerability extends beyond simple device compromise, as it enables attackers to gain unauthorized control over network infrastructure managed by Tenda G0 devices. The availability of public exploits for this specific weakness significantly increases the risk surface, as cybercriminals can readily leverage this vulnerability to establish persistent access points within networks. Given that many IoT devices remain unpatched due to user neglect or lack of automatic update mechanisms, this vulnerability presents a substantial threat to network security, particularly in environments where these devices serve as gateways or network management interfaces.
Mitigation strategies should prioritize immediate firmware updates from Tenda, though organizations must also implement network segmentation and access controls to limit potential attack vectors. The vulnerability aligns with CWE-121 stack-based buffer overflow classification and represents a technique commonly referenced in ATT&CK framework under initial access and execution phases. Network administrators should consider implementing intrusion detection systems that monitor for suspicious parameter patterns in web interface requests, while also ensuring that default credentials are changed and unnecessary services are disabled on affected devices to reduce the attack surface.