The vulnerability is a command injection flaw in the Boa Webserver component on the Tenda HG10 router. By crafting a malicious value for the serverString argument in the /boaform/formSamba endpoint, an attacker can execute arbitrary operating‑system commands on the device. This flaw can be triggered remotely. The description does not specify whether authentication is required to access the endpoint, so the need for credentials remains uncertain.

The affected product is the Tenda HG10 router, specifically the firmware version identified as US_HG7_HG9_HG10re_300001138_en_xpon. No other vendors or product families are listed, and the vulnerability is confined to this specific model.

The CVSS score of 6.9 indicates medium severity, and an EPSS score of 2% indicates a low probability of exploitation. The vulnerability is publicly available, and there is no listing in the CISA KEV catalog, so it has not yet been confirmed as an active exploited vulnerability. The attack vector is remote, as the command injection can be exercised over the network by sending HTTP requests to the exposed Boa Webserver interface.