This issue is rated as high severity due to the potential for unauthenticated or authenticated remote code execution or a complete denial of service of the network device. The vulnerability affects all Tenda G0 firmware versions up to 20260625. Publicly available exploit code exists for this vulnerability, increasing the risk of active exploitation against vulnerable devices exposed to the internet. Defenders should prioritize isolating management interfaces of these devices from public access.

Attack Chain

1. Attacker performs reconnaissance to identify exposed Tenda G0 management interfaces via scanners.
2. Attacker establishes a session or interacts with the /goform/module endpoint on the web management interface.
3. Attacker crafts an HTTP POST request targeting the setPortMapping function.
4. Attacker injects a payload into the portMappingServer, porMappingtInternal, or portMappingExternal parameters.
5. The target application fails to perform proper bounds checking on the input, causing a buffer overflow.
6. The attacker overwrites the instruction pointer to redirect execution flow.
7. Attacker executes arbitrary code on the underlying device firmware.
8. Final objective achieved, resulting in system compromise or persistent device disruption.

Impact

Successful exploitation of CVE-2026-19792 allows a remote attacker to achieve arbitrary code execution on affected Tenda G0 routers. This could lead to full device compromise, allowing for traffic interception, lateral movement into the local network, or permanent denial of service. The vulnerability is exploitable remotely, making any device with an exposed web management interface a target.

Recommendation

• Implement immediate network-level access control to restrict access to the web management interface of Tenda G0 devices to known, trusted management segments only.
• Disable remote access to the web management interface from the WAN side if not strictly required.
• Monitor network traffic for HTTP POST requests directed at /goform/module containing unusual string lengths or shellcode patterns in the specified parameters.
• Ensure firmware is updated to versions released after 20260625 if a vendor patch becomes available.