High severity · published Aug 14, 2026
CVE-2026-19792
Tenda G0 httpd web management interface module setPortMapping buffer overflow
8.8
CVSS
0.9%
EPSS
No
On KEV
Description
A security flaw has been discovered in Tenda G0 up to 20260625. Impacted is the function setPortMapping of the file /goform/module of the component httpd web management interface. Performing a manipulation of the argument portMappingServer/porMappingtInternal/portMappingExternal results in buffer overflow. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.9% · higher than 58% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
G0
G0 · Tenda
20260625 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-19792
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-19792
github.com
https://github.com/lipenghai/iot_bug/blob/main/Tenda/G0/3.md
vuldb.com
https://vuldb.com/cve/CVE-2026-19792
vuldb.com
https://vuldb.com/submit/868929
vuldb.com
https://vuldb.com/vuln/389758
vuldb.com
https://vuldb.com/vuln/389758/cti
www.tenda.com.cn
https://www.tenda.com.cn/
More from G0
8.8
CVE-2026-19791
Tenda G0 httpd web management interface module addStaticRoute stack-based overflow
8.8
CVE-2026-19790
Tenda G0 httpd Web Management module formSetPortMirror stack-based overflow