Description
A vulnerability was determined in Tenda HG10 300001138. This issue affects the function formWanRedirect of the file /boaform/formWanRedirect of the component Boa Web Server. Executing a manipulation of the argument if can lead to buffer overflow. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized.
Published: 2026-09-06
Score: 8.7 High
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution via buffer overflow in Boa Web Server
Action: Immediate Patch
AI Analysis

Impact

A buffer overflow exists in the formWanRedirect function of Tenda HG10’s Boa Web Server, allowing attackers to manipulate the ‘if’ argument and inject arbitrary data. This flaw, categorized as CWE-119 and CWE-120, can be exploited remotely to potentially execute arbitrary code, resulting in loss of confidentiality, integrity, and availability for the affected device.

Affected Systems

The vulnerability affects Tenda HG10 firmware version 300001138, targeting the Boa Web Server component and specifically the /boaform/formWanRedirect endpoint. Devices running this firmware are thus at risk.

Risk and Exploitability

The CVSS score of 8.7 indicates a high severity. EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog, however the exploit is publicly disclosed and can be launched remotely. Attackers with network access to the device could trigger the buffer overflow and gain control of the router.

Generated by OpenCVE AI on September 6, 2026 at 05:20 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the vendor’s firmware update that mitigates the buffer overflow when available.
  • If no update exists, block or disable the Boa Web Server or the /boaform/formWanRedirect endpoint using firewall rules to prevent remote access to the vulnerable function.
  • Continuously monitor logs and network traffic for attempts to send oversized ‘if’ parameters to the formWanRedirect endpoint and block offenders.

Generated by OpenCVE AI on September 6, 2026 at 05:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 11 Sep 2026 23:45:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Sun, 06 Sep 2026 05:45:00 +0000

Type Values Removed Values Added
First Time appeared Tenda hg10
Vendors & Products Tenda hg10

Sun, 06 Sep 2026 04:15:00 +0000

Type Values Removed Values Added
Description A vulnerability was determined in Tenda HG10 300001138. This issue affects the function formWanRedirect of the file /boaform/formWanRedirect of the component Boa Web Server. Executing a manipulation of the argument if can lead to buffer overflow. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized.
Title Tenda HG10 Boa Web Server formWanRedirect buffer overflow
First Time appeared Tenda
Tenda hg10 Firmware
Weaknesses CWE-119
CWE-120
CPEs cpe:2.3:o:tenda:hg10_firmware:*:*:*:*:*:*:*:*
Vendors & Products Tenda
Tenda hg10 Firmware
References
Metrics cvssV2_0

{'score': 9, 'vector': 'AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 8.8, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Tenda Hg10 Hg10 Firmware
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-09-11T20:36:58.513Z

Reserved: 2026-09-05T10:32:03.953Z

Link: CVE-2026-86166

cve-icon Vulnrichment

Updated: 2026-09-11T20:15:49.501Z

cve-icon NVD

Status : Deferred

Published: 2026-09-06T04:18:32.783

Modified: 2026-09-11T21:17:35.040

Link: CVE-2026-86166

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-06T05:30:18Z

Weaknesses
  • CWE-119

    Improper Restriction of Operations within the Bounds of a Memory Buffer

  • CWE-120

    Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')