Description
A flaw has been found in Tenda HG9 300001138. This vulnerability affects unknown code of the file /boaform/formPing6. Executing a manipulation of the argument pingAddr can lead to stack-based buffer overflow. The attack may be performed from remote. The exploit has been published and may be used.
Published: 2026-02-22
Score: 8.7 High
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution
Action: Immediate Patch
AI Analysis

Impact

Tenda HG9 routers running firmware 300001138 contain a stack-based buffer overflow in the web interface endpoint /boaform/formPing6 when the pingAddr parameter is manipulated. The overflow can corrupt the stack and lead to arbitrary code execution on the device. The weakness is classified under CWE-119 (Improper Restriction of Operations within the Bounds of a Buffer) and CWE-121 (Stack-based Buffer Overflow).

Affected Systems

The flaw affects Tenda HG9 devices, specifically firmware version 300001138. The vulnerability exists in the unknown code path handling the formPing6 request, which is part of the router’s web management interface.

Risk and Exploitability

The CVSS score of 8.7 marks the issue as High severity. The EPSS score of under 1% indicates low but non-zero likelihood of exploitation in the wild, and the flaw has not been included in the CISA KEV catalog. Attackers can reach the vulnerable endpoint remotely via the router’s web interface, likely over HTTP/HTTPS, and by sending a crafted pingAddr value gain remote code execution. No specific conditions or user privileges are required beyond external network access to the router’s management interface.

Generated by OpenCVE AI on April 17, 2026 at 16:36 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update the router to the latest firmware from Tenda, which contains the fix for the formPing6 handling in the web interface.
  • If a new firmware is not yet available, block external access to the router’s administrative web interface (e.g., firewalls, VLAN segregation) or disable the /boaform/formPing6 endpoint through router configuration or custom URL filtering.
  • Restrict administrative access to the router strictly to trusted internal networks and enforce strong, unique passwords; consider using a VPN for remote management instead of direct internet exposure.

Generated by OpenCVE AI on April 17, 2026 at 16:36 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 23 Feb 2026 20:30:00 +0000

Type Values Removed Values Added
First Time appeared Tenda hg9 Firmware
CPEs cpe:2.3:h:tenda:hg9:-:*:*:*:*:*:*:*
cpe:2.3:o:tenda:hg9_firmware:300001138:*:*:*:*:*:*:*
Vendors & Products Tenda hg9 Firmware

Mon, 23 Feb 2026 20:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Mon, 23 Feb 2026 15:00:00 +0000

Type Values Removed Values Added
First Time appeared Tenda
Tenda hg9
Vendors & Products Tenda
Tenda hg9

Sun, 22 Feb 2026 03:30:00 +0000

Type Values Removed Values Added
Description A flaw has been found in Tenda HG9 300001138. This vulnerability affects unknown code of the file /boaform/formPing6. Executing a manipulation of the argument pingAddr can lead to stack-based buffer overflow. The attack may be performed from remote. The exploit has been published and may be used.
Title Tenda HG9 formPing6 stack-based overflow
Weaknesses CWE-119
CWE-121
References
Metrics cvssV2_0

{'score': 9, 'vector': 'AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 8.8, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Tenda Hg9 Hg9 Firmware
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-02-23T19:17:27.114Z

Reserved: 2026-02-20T20:14:51.686Z

Link: CVE-2026-2910

cve-icon Vulnrichment

Updated: 2026-02-23T19:17:21.449Z

cve-icon NVD

Status : Analyzed

Published: 2026-02-22T04:15:57.647

Modified: 2026-02-23T20:21:31.247

Link: CVE-2026-2910

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-17T16:45:15Z

Weaknesses