CVE-2026-19790 - Exploits & Severity

Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119)

A stack-based buffer overflow vulnerability exists in the formSetPortMirror function of the httpd Web Management Interface in Tenda G0 up to version 20260625. The vulnerability is triggered through manipulation of the portMirrorMirroredPorts argument in the /goform/module endpoint. A public exploit is available for this vulnerability.

An authenticated user with low privileges can remotely trigger this vulnerability over the network to execute arbitrary code, modify system data, or crash the service on the affected Tenda G0 device.

There is no evidence that a public proof-of-concept exists. There is no evidence of proof of exploitation at the moment.

Patch is available. See GitHub Advisory GHSA-hrjq-f2xj-8982 for patch details.

Update Tenda G0 to a version newer than 20260625. Apply patches referenced in the GitHub advisory. Restrict network access to the httpd Web Management Interface to trusted administrative users only. Monitor for exploitation attempts targeting the /goform/module endpoint.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Feedly found the first article mentioning CVE-2026-19790 . See article

NVD published the first details for CVE-2026-19790

A CVSS base score of 8.8 has been assigned.

GitHub Advisories released a security advisory .

Critical Stack-based Buffer Overflow Vulnerability in Tenda G0 Devices

CVE-2026-19790 - Exploits & Severity - Feedly

CVE-2026-19790: Stack-based Buffer Overflow in Tenda G0

CVE-2026-19790 A vulnerability was identified in Tenda G0 up to 20260625. This issue affects the function formSetPortMirror of the file /goform/module of the component httpd Web Man…

Collect, analyze, and vulnerability reports faster using AI