A vulnerability exists in the Tenda HG10 router’s web interface at /boaform/formSysCmd that allows an attacker to inject arbitrary system commands via the sysCmd parameter. The lack of input validation enables the commands to run with device privileges, permitting remote execution of system commands. The flaw is publicly documented and can be triggered from outside the network.

The affected vendor is Tenda, model HG10 routers. Firmware versions include US_HG7_HG9_HG10re_300001138_en_xpon, and any related builds that expose the same vulnerable endpoint. Identified CPEs show this impact across Tenda HG10 hardware and firmware families.

The CVSS score of 5.1 indicates moderate risk, while an EPSS score of 4% suggests a low but non‑zero likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw remotely through the router’s web interface by sending a crafted sysCmd parameter that causes arbitrary system commands to execute with device privileges. This remote command execution gives an attacker the ability to modify router configuration, disrupt service, or compromise the host running the firmware.