Description
A security flaw has been discovered in Tenda HG9 300001138. Affected is an unknown function of the file /boaform/formSamba of the component Samba Configuration Endpoint. The manipulation of the argument sambaCap results in stack-based buffer overflow. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks.
Published: 2026-02-22
Score: 8.7 High
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution
Action: Immediate Patch
AI Analysis

Impact

A stack-based buffer overflow exists in the Samba configuration endpoint of the Tenda HG9 firmware, where manipulation of the sambaCap parameter overflows the stack. This flaw can allow an attacker to execute arbitrary code, representing a high severity vulnerability according to CVSS. The weakness is identified as CWE-119 (Improper Restriction of Operations within the Bounds of a Buffer) and CWE-121 (Stack-based Buffer Overwrite).

Affected Systems

The affected devices are Tenda HG9 routers running firmware version 300001138. The vulnerable component is accessed via the /boaform/formSamba endpoint of the router’s administration interface.

Risk and Exploitability

The CVSS score of 8.7 indicates severe impact, while the EPSS score of less than 1% shows a low but non-zero likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog, but public exploits have already been released, enabling remote attackers to trigger the overflow and potentially gain full control over the device.

Generated by OpenCVE AI on April 17, 2026 at 16:37 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the latest firmware update released by Tenda that addresses the stack overflow in the Samba configuration endpoint.
  • If a firmware update is not yet available, disable or remove the /boaform/formSamba endpoint or prevent remote access to it via firewall or access control settings.
  • Configure network segmentation or firewall rules to restrict remote management traffic to trusted IP addresses only.

Generated by OpenCVE AI on April 17, 2026 at 16:37 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 24 Feb 2026 16:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Mon, 23 Feb 2026 20:30:00 +0000

Type Values Removed Values Added
First Time appeared Tenda hg9 Firmware
CPEs cpe:2.3:h:tenda:hg9:-:*:*:*:*:*:*:*
cpe:2.3:o:tenda:hg9_firmware:300001138:*:*:*:*:*:*:*
Vendors & Products Tenda hg9 Firmware

Mon, 23 Feb 2026 15:00:00 +0000

Type Values Removed Values Added
First Time appeared Tenda
Tenda hg9
Vendors & Products Tenda
Tenda hg9

Sun, 22 Feb 2026 02:15:00 +0000

Type Values Removed Values Added
Description A security flaw has been discovered in Tenda HG9 300001138. Affected is an unknown function of the file /boaform/formSamba of the component Samba Configuration Endpoint. The manipulation of the argument sambaCap results in stack-based buffer overflow. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks.
Title Tenda HG9 Samba Configuration Endpoint formSamba stack-based overflow
Weaknesses CWE-119
CWE-121
References
Metrics cvssV2_0

{'score': 9, 'vector': 'AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 8.8, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Tenda Hg9 Hg9 Firmware
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-02-24T15:38:54.600Z

Reserved: 2026-02-20T20:14:40.341Z

Link: CVE-2026-2906

cve-icon Vulnrichment

Updated: 2026-02-24T15:38:25.950Z

cve-icon NVD

Status : Analyzed

Published: 2026-02-22T02:16:57.493

Modified: 2026-02-23T20:22:01.890

Link: CVE-2026-2906

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-17T16:45:15Z

Weaknesses