CVE-2026-11499
CriticalCVSS 9.8Exploitation Probability (EPSS)
Very high risk93th percentile - higher than 93% of all known CVEs
Summary
A vulnerability in Tenda HG7, HG9, and HG10 devices (firmware version 300001138_en_xpon) in the formDOMAINBLK function of /boaform/formDOMAINBLK. Manipulating the blkDomain argument leads to a stack-based buffer overflow. The attack can be performed remotely.
Risk Assessment
An attacker can remotely trigger a buffer overflow, potentially leading to arbitrary code execution on the device and full control over the router.
Recommendation
Contact Tenda for a firmware update or apply workarounds such as restricting access to the management interface.
Original NVD description (English source)
A vulnerability was determined in Tenda HG7HG9 and HG10 300001138_en_xpon. This affects the function formDOMAINBLK of the file /boaform/formDOMAINBLK. Executing a manipulation of the argument blkDomain can lead to stack-based buffer overflow. The attack may be performed from remote.