CVE-2026-86165
CriticalCVSS 9.8Summary
A vulnerability was found in Tenda HG10 (version 300001138) in the formURL function of the /boaform/admin/formURL file. Manipulation of the Keywd/urlFQDN arguments results in a buffer overflow. The attack can be initiated remotely, and the exploit has been made public.
Risk Assessment
Buffer overflow could allow remote code execution or cause a denial of service, potentially disrupting network operations.
Recommendation
Update the Tenda HG10 firmware to the latest version and restrict access to the administrative interface.
Other vulnerabilities in Tenda HG10
See all- CVE-2026-86166High
A vulnerability was determined in Tenda HG10 (version 300001138) in the formWanRedirect function of the /boaform/formWanRedirect file in the Boa Web Server component. Executing a manipulation of the 'if' argument can lead to a buffer overflow. The attack may be launched remotely, and the exploit has been publicly disclosed.
- CVE-2026-85110High
In Tenda HG10 (version 300001138), the function formWlanSetup in the file /boaform/formWlanSetup of the Boa Web Server component has a buffer overflow caused by manipulation of the ssid argument. Remote exploitation is possible, and the exploit is publicly available.
- CVE-2026-86167Critical
A vulnerability was identified in Tenda HG10 (version 300001138) in the formgponConf function of the /boaform/admin/formgponConf file in the Boa component. Manipulation of the fmgpon_loid argument leads to OS command injection. The attack can be performed remotely, and the exploit is publicly available.
- CVE-2026-85109Critical
A vulnerability was determined in Tenda HG10 300001138. This issue affects the function formLogin of the file /boaform/formLogin of the component Boa Web Server. Executing a manipulation of the argument Username can lead to buffer overflow. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized.
- CVE-2026-82542Critical
A vulnerability in Tenda HG10 300001138 affects the formIPv6Routing function in the file /boaform/admin/formIPv6Routing of the Boa Web Server component. Manipulation of the destNet argument causes a buffer overflow. The attack can be carried out remotely, and the exploit is publicly available.
Original NVD description (English source)
A vulnerability was found in Tenda HG10 300001138. This vulnerability affects the function formURL of the file /boaform/admin/formURL. Performing a manipulation of the argument Keywd/urlFQDN results in buffer overflow. The attack may be initiated remotely. The exploit has been made public and could be used.