A buffer overflow occurs when the Boa Service processes the nextHop argument in the formRouting form. The vulnerability resides in the formRoute function of /boaform/formRouting within the Tenda HG10 firmware. Because the overflow is triggered by crafted input, an attacker can control memory and potentially execute arbitrary code, resulting in full system compromise. The CVSS score of 8.7 indicates high severity and the description confirms that the exploit is publicly available.

The flaw affects the Tenda HG10 device running firmware build HG7_HG9_HG10re_300001138_en_xpon. Users employing this model are at risk if they remain on that firmware version.

Given the CVSS of 8.7 and an EPSS score of less than 1%, the technical severity is high but the probability of widespread exploitation remains low at this time. The vulnerability is not listed in CISA's KEV catalog. The attack vector is remote, allowing an adversary to send malicious requests to the affected Boa Service endpoint. Since the exploit has been published, a determined attacker could achieve remote code execution from a network exposed to the device.