A vulnerability in the Tenda HG10 router's web interface at /boaform/formSysCmd lets attackers inject arbitrary system commands through the sysCmd parameter. The lack of input validation means the commands run with device privileges. The flaw is publicly documented and can be triggered from outside the network.

The affected vendor is Tenda, model HG10 routers. Firmware versions include US_HG7_HG9_HG10re_300001138_en_xpon, and any related builds that expose the same vulnerable endpoint. Identified CPEs show this impact across Tenda HG10 hardware and firmware families.

The CVSS score of 5.1 indicates moderate impact, while an EPSS score of 1% suggests low but nonzero likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw remotely through the router's web interface, sending a crafted sysCmd parameter that executes system commands on the device. Because the command injection is unfiltered, an attacker could gain full control of the router, enabling lateral movement and other attacks within the user’s network.