CVE-2026-85109
CriticalCVSS 9.8Summary
A vulnerability was determined in Tenda HG10 300001138. This issue affects the function formLogin of the file /boaform/formLogin of the component Boa Web Server. Executing a manipulation of the argument Username can lead to buffer overflow. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized.
Risk Assessment
The risk includes remote code execution or device crash, potentially leading to device takeover and network security compromise.
Recommendation
It is recommended to apply vendor patches immediately and restrict access to the administrative interface to trusted networks only.
Other vulnerabilities in Tenda HG10
See all- CVE-2026-85110High
In Tenda HG10 (version 300001138), the function formWlanSetup in the file /boaform/formWlanSetup of the Boa Web Server component has a buffer overflow caused by manipulation of the ssid argument. Remote exploitation is possible, and the exploit is publicly available.
- CVE-2026-82542Critical
A vulnerability in Tenda HG10 300001138 affects the formIPv6Routing function in the file /boaform/admin/formIPv6Routing of the Boa Web Server component. Manipulation of the destNet argument causes a buffer overflow. The attack can be carried out remotely, and the exploit is publicly available.
Original NVD description (English source)
A vulnerability was determined in Tenda HG10 300001138. This issue affects the function formLogin of the file /boaform/formLogin of the component Boa Web Server. Executing a manipulation of the argument Username can lead to buffer overflow. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized.