A command injection flaw exists in the Tenda HG10 firmware, specifically in the checkUserFromLanOrWan function of the Login Interface. By supplying a crafted Host argument to the /boaform/admin/formLogin endpoint, an attacker can cause the router to execute arbitrary shell commands. This vulnerability is classified under CWE‑74 (Improper Neutralization of Input During Web Page Generation) and CWE‑77 (Improper Neutralization of Special Elements used in an OS Command). The resulting impact is the ability to take full control of the device, compromising confidentiality, integrity, and availability.

The impacted product is the Tenda HG10 router, running firmware identified as Tenda HG10 US_HG7_HG9_HG10re_300001138_en_xpon. No specific firmware revision is listed beyond this general identifier, indicating that any build under this firmware line is potentially affected. The vendor is Tenda.

The CVSS score of 6.9 places the vulnerability in the medium severity range, and the EPSS score of 5% suggests a measurable likelihood of exploitation. The vulnerability is not currently listed in the CISA KEV catalog. Attackers can launch the exploit remotely by targeting the exposed login interface; the exploit has been made public and may already be in use. Successful exploitation would grant an attacker arbitrary command execution on the router, leading to full device compromise.