CVE-2026-11553
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk38th percentile - higher than 38% of all known CVEs
Summary
Vulnerability in Tenda HG7, HG9, and HG10 (version 300001138_en_xpon) in the formPPPEdit function. Manipulation of the encodename argument leads to stack-based buffer overflow, enabling remote attack.
Risk Assessment
Risk of remote code execution or device disruption on Tenda HG7/HG9/HG10 devices.
Recommendation
Update Tenda device firmware to the latest version. Restrict access to the management interface.
Other vulnerabilities in Tenda HG7/HG9/HG10
See all- CVE-2026-11499Critical
A vulnerability in Tenda HG7, HG9, and HG10 devices (firmware version 300001138_en_xpon) in the formDOMAINBLK function of /boaform/formDOMAINBLK. Manipulating the blkDomain argument leads to a stack-based buffer overflow. The attack can be performed remotely.
- CVE-2026-11498High
In Tenda HG7, HG9, and HG10 devices with firmware 300001138_en_xpon, a stack-based buffer overflow exists in the asp_voip_OtherSet function in /boaform/voip_other_set of the Web Management Interface. Remote manipulation of the funckey_transfer argument triggers the overflow.
Original NVD description (English source)
A vulnerability was found in Tenda HG7HG9 and HG10 300001138_en_xpon. This affects the function formPPPEdit of the file /boaform/formPPPEdit. The manipulation of the argument encodename results in stack-based buffer overflow. The attack can be launched remotely. The exploit has been made public and could be used.