The vulnerability resides in the Boa Web Server’s formWlanSetup function on Tenda HG10 routers, where the ssid argument is not properly validated and can overflow a buffer. This classic buffer overflow falls under CWE‑119 and CWE‑120, allowing an attacker who can supply the ssid value to corrupt memory and potentially execute arbitrary code on the device, leading to full system compromise.

All Tenda HG10 routers running firmware version 300001138 are affected. The issue is specific to the Boa Web Server component accessed through the /boaform/formWlanSetup path.

The CVSS score of 8.7 classifies this flaw as High severity. EPSS data is not available, but the vulnerability is publicly documented and an exploit is already available, indicating a realistic probability of exploitation. The problem can be triggered remotely via the router’s web interface, which is typically reachable on the local network and could be exposed to the internet in misconfigured deployments. The flaw is not listed in the CISA KEV catalog, but the presence of an exploit in the wild makes it a critical risk for unattended or unpatched devices.