Description
A vulnerability was found in Tenda HG10 300001138. This vulnerability affects the function formURL of the file /boaform/admin/formURL. Performing a manipulation of the argument Keywd/urlFQDN results in buffer overflow. The attack may be initiated remotely. The exploit has been made public and could be used.
Published: 2026-09-06
Score: 9.3 Critical
EPSS: 1.1% Low
KEV: No
Impact: Remote Code Execution
Action: Immediate Patch
AI Analysis

Impact

A buffer overflow flaw exists in the formURL function of Tenda HG10 firmware version 300001138. Manipulating the Keywd/urlFQDN argument triggers an overflow in the server’s input handling, potentially allowing an attacker to execute arbitrary code or crash the device. The vulnerability is characterized by the CWE-119 and CWE-120 weaknesses, indicating improper bounds checking and unsafe buffer operations.

Affected Systems

Tenda HG10 home gateway devices, specifically firmware iteration 300001138. The flaw is exposed through the /boaform/admin/formURL endpoint accessible on the device’s local network.

Risk and Exploitability

The CVSS score of 9.3 classifies this issue as Critical, reflecting a high likelihood of exploitation and severe impact. The EPSS score is reported as unavailable, but the public availability of an exploit suggests a non-negligible risk. The vulnerability is not listed in the CISA KEV catalog, yet the remote trigger and public exploitability elevate the immediate threat level.

Generated by OpenCVE AI on September 6, 2026 at 04:20 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update the device firmware to the latest version released by Tenda that addresses the buffer overflow in formURL
  • If a firmware update is not immediately available, restrict remote access to the /boaform/admin/formURL endpoint by configuring firewall rules or disabling remote administration features
  • As a temporary measure, limit the size of the Keywd/urlFQDN input through network traffic filtering or validate input length in the router’s configuration interface to mitigate the overflow impact

Generated by OpenCVE AI on September 6, 2026 at 04:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 08 Sep 2026 14:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Sun, 06 Sep 2026 05:15:00 +0000

Type Values Removed Values Added
First Time appeared Tenda hg10
Vendors & Products Tenda hg10

Sun, 06 Sep 2026 03:45:00 +0000

Type Values Removed Values Added
Description A vulnerability was found in Tenda HG10 300001138. This vulnerability affects the function formURL of the file /boaform/admin/formURL. Performing a manipulation of the argument Keywd/urlFQDN results in buffer overflow. The attack may be initiated remotely. The exploit has been made public and could be used.
Title Tenda HG10 formURL buffer overflow
First Time appeared Tenda
Tenda hg10 Firmware
Weaknesses CWE-119
CWE-120
CPEs cpe:2.3:o:tenda:hg10_firmware:*:*:*:*:*:*:*:*
Vendors & Products Tenda
Tenda hg10 Firmware
References
Metrics cvssV2_0

{'score': 10, 'vector': 'AV:N/AC:L/Au:N/C:C/I:C/A:C/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 9.8, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 9.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Tenda Hg10 Hg10 Firmware
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-09-08T13:26:12.197Z

Reserved: 2026-09-05T10:31:59.598Z

Link: CVE-2026-86165

cve-icon Vulnrichment

Updated: 2026-09-08T13:26:08.298Z

cve-icon NVD

Status : Deferred

Published: 2026-09-06T04:18:32.523

Modified: 2026-09-08T14:17:31.267

Link: CVE-2026-86165

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-06T05:15:03Z

Weaknesses
  • CWE-119

    Improper Restriction of Operations within the Bounds of a Memory Buffer

  • CWE-120

    Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')