CVE-2026-11498
HighCVSS 8.8Exploitation Probability (EPSS)
High risk89th percentile - higher than 89% of all known CVEs
Summary
In Tenda HG7, HG9, and HG10 devices with firmware 300001138_en_xpon, a stack-based buffer overflow exists in the asp_voip_OtherSet function in /boaform/voip_other_set of the Web Management Interface. Remote manipulation of the funckey_transfer argument triggers the overflow.
Risk Assessment
A remote attacker can exploit this vulnerability to execute arbitrary code or crash the device, compromising network security.
Recommendation
Update the Tenda device firmware to a patched version or restrict access to the web management interface.
Other vulnerabilities in Tenda HG7/HG9/HG10
See all- CVE-2026-11499Critical
A vulnerability in Tenda HG7, HG9, and HG10 devices (firmware version 300001138_en_xpon) in the formDOMAINBLK function of /boaform/formDOMAINBLK. Manipulating the blkDomain argument leads to a stack-based buffer overflow. The attack can be performed remotely.
- CVE-2026-11553High
Vulnerability in Tenda HG7, HG9, and HG10 (version 300001138_en_xpon) in the formPPPEdit function. Manipulation of the encodename argument leads to stack-based buffer overflow, enabling remote attack.
Original NVD description (English source)
A vulnerability was found in Tenda HG7HG9 and HG10 300001138_en_xpon. Affected by this issue is the function asp_voip_OtherSet of the file /boaform/voip_other_set of the component Web Management Interface. Performing a manipulation of the argument funckey_transfer results in stack-based buffer overflow. The attack is possible to be carried out remotely.