A critical buffer overflow vulnerability in Tenda G0 allows authenticated attackers to remotely execute arbitrary code by manipulating port mapping parameters.

The vulnerability exists within the setPortMapping function of the /goform/module file. By injecting oversized data into the portMappingServer, porMappingtInternal, or portMappingExternal arguments, an authenticated attacker can trigger a memory corruption event.

The CVSS score of 8.8 highlights the severe impact of this vulnerability. Successful exploitation permits remote code execution, which may lead to complete device takeover, unauthorized modification of network configurations, or the exfiltration of sensitive traffic passing through the gateway.

Immediate Action: Monitor official Tenda security channels for firmware patches. In the interim, restrict access to the web management interface to authorized management subnets.

Proactive Monitoring: Audit logs for suspicious activity targeting the /goform/module file, specifically searching for malformed input in port mapping configuration requests.

Compensating Controls: Utilize a Web Application Firewall (WAF) or network ACLs to filter traffic to the web management interface, ensuring that only known, trusted administrative entities can access the affected functions.

Public Exploit Available: Yes, a public proof-of-concept exists via GitHub.

The combination of a high CVSS score and the existence of public exploit code necessitates immediate defensive action. Organizations using the affected Tenda G0 hardware should implement strict network segmentation to block unauthorized access to the web interface while awaiting a permanent firmware fix from the manufacturer.