This vulnerability in Tenda G0 up to version 20260625 involves a stack-based buffer overflow in the formSetPortMirror function of the httpd Web Management Interface component, specifically in the /goform/module file. The issue arises from improper manipulation of the portMirrorMirroredPorts argument, enabling remote attackers to cause a buffer overflow on the stack. The vulnerability has a CVSS 4.0 score of 8.7, indicating high severity, and public exploit code is available. No vendor advisory or patch information is currently available, and the device is not a cloud service.

Successful exploitation of this vulnerability can lead to remote code execution or denial of service due to the stack-based buffer overflow. Given the high CVSS score and public availability of exploit code, affected devices are at significant risk if exposed to untrusted networks. The vulnerability requires no user interaction and can be triggered remotely with low attack complexity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, it is recommended to restrict access to the device's web management interface from untrusted networks and monitor for any suspicious activity related to portMirrorMirroredPorts manipulation. Avoid exposing the management interface to the internet.