Description
A security vulnerability has been detected in Tenda HG7, HG9 and HG10 300001138_en_xpon. This impacts the function boaGetVar of the file /boaform/formLoopBack of the component Boa Web Server. Such manipulation of the argument Ethtype leads to stack-based buffer overflow. The attack can be executed remotely. The exploit has been disclosed publicly and may be used.
Published: 2026-10-02
Score: 10 Critical
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution
Action: Immediate Patch
AI Analysis

Impact

A stack-based buffer overflow exists in the Boa Web Server component of Tenda HG7, HG9, and HG10 routers. Malicious manipulation of the Ethtype argument in the boaGetVar function of /boaform/formLoopBack overwrites critical stack memory, enabling an attacker to execute arbitrary code on the device. The flaw allows a remote attacker to compromise the router’s confidentiality, integrity, and availability.

Affected Systems

The affected hardware includes Tenda’s HG7, HG9, and HG10 router models. Firmware 300001138_en_xpon is vulnerable. No specific firmware version ranges are disclosed; the issue appears in the current releases referenced in the advisory.

Risk and Exploitability

The flaw carries a maximum CVSS score of 10, indicating critical severity. No EPSS data is currently available, though the public disclosure suggests that attackers may already have a working exploit. The vulnerability is not yet included in CISA’s KEV catalog, but remote exploitation is feasible via the web interface, allowing an attacker to achieve remote code execution with no authentication requirement.

Generated by OpenCVE AI on October 2, 2026 at 13:56 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest firmware update supplied by Tenda that addresses this stack overflow.
  • Disable or remove the Boa Web Server interface if the router can operate without it.
  • Introduce firewall rules to block external access to the /boaform path or the router’s HTTP port.
  • Restrict management access to trusted internal networks and enforce strong authentication.
  • Monitor router logs for abnormal HTTP requests attempting to exploit /boaform/formLoopBack.

Generated by OpenCVE AI on October 2, 2026 at 13:56 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 02 Oct 2026 14:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Fri, 02 Oct 2026 12:30:00 +0000

Type Values Removed Values Added
Description A security vulnerability has been detected in Tenda HG7, HG9 and HG10 300001138_en_xpon. This impacts the function boaGetVar of the file /boaform/formLoopBack of the component Boa Web Server. Such manipulation of the argument Ethtype leads to stack-based buffer overflow. The attack can be executed remotely. The exploit has been disclosed publicly and may be used.
Title Tenda HG7/HG9/HG10 Boa Web Server formLoopBack boaGetVar stack-based overflow
First Time appeared Tenda
Tenda hg10
Tenda hg7
Tenda hg9
Weaknesses CWE-119
CWE-121
CPEs cpe:2.3:h:tenda:hg10:*:*:*:*:*:*:*:*
cpe:2.3:h:tenda:hg7:*:*:*:*:*:*:*:*
cpe:2.3:h:tenda:hg9:*:*:*:*:*:*:*:*
Vendors & Products Tenda
Tenda hg10
Tenda hg7
Tenda hg9
References
Metrics cvssV2_0

{'score': 10, 'vector': 'AV:N/AC:L/Au:N/C:C/I:C/A:C/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 10, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 10, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 10, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P'}

Subscriptions

Tenda Hg10 Hg7 Hg9
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-10-02T13:50:12.393Z

Reserved: 2026-10-02T03:49:26.992Z

Link: CVE-2026-104610

cve-icon Vulnrichment

Updated: 2026-10-02T13:50:03.515Z

cve-icon NVD

Status : Deferred

Published: 2026-10-02T13:17:44.450

Modified: 2026-10-02T14:17:09.267

Link: CVE-2026-104610

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-02T14:30:23Z

Weaknesses
  • CWE-119

    Improper Restriction of Operations within the Bounds of a Memory Buffer

  • CWE-121

    Stack-based Buffer Overflow