CVE-2026-36800: Shenzhen Tenda Technology Co

Synopsis

A buffer overflow vulnerability affects the Tenda G0 router (firmware v15.11.0.5), specifically in the formIPMacBindDel function when processing the IPMacBindIndex parameter. The flaw is reachable over the network without any authentication or user interaction, meaning any attacker who can send HTTP requests to the device can trigger it. Successful exploitation crashes the affected service, causing a denial of service. No fix version has been published yet; HarborGuard tracks the advisory and will surface a patched rebuild the moment upstream ships a fix.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable function is exposed over the network via HTTP, so an attacker must be able to send requests to the device's web interface to trigger the overflow.

• AuthenticationNot required

  No credentials are needed; the vulnerable endpoint can be reached by any unauthenticated HTTP request.

• Victim interactionNot required

  The attack is fully remote and passive on the victim side; no user action such as clicking a link or opening a file is required.

• Attack complexityDetail

  Exploitation is straightforward and condition-free; the attacker simply sends a crafted HTTP request with a malformed IPMacBindIndex value, with no race conditions or special environmental factors needed.

Blast Radius

• Crashes the formIPMacBindDel service process, taking down the affected router function until the device is restarted.
• Disrupts network connectivity for all clients relying on the device, as the DoS can render the router unresponsive.