EUVD-2026-35029
GHSA-xv62-77m9-3736
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability was determined in Tenda HG7HG9 and HG10 300001138_en_xpon. This affects the function formDOMAINBLK of the file /boaform/formDOMAINBLK. Executing a manipulation of the argument blkDomain can lead to stack-based buffer overflow. The attack may be performed from remote.
AnalysisAI
Stack-based buffer overflow in Tenda HG7HG9 and HG10 routers (firmware 300001138_en_xpon) allows remote attackers to corrupt memory via the blkDomain parameter in the formDOMAINBLK handler at /boaform/formDOMAINBLK. The CVSS 4.0 score of 9.3 reflects network-reachable, unauthenticated exploitation with high impact to confidentiality, integrity, and availability, and a public proof-of-concept repository has been published on GitHub by researcher ssaaaa1234, though no public exploit has been confirmed as active exploitation.
Technical ContextAI
The vulnerable component is the boa web server's formDOMAINBLK handler, used for domain blocking/filtering configuration on Tenda HG-series xPON ONT (optical network termination) gateways. CWE-121 (stack-based buffer overflow) indicates the blkDomain argument is copied into a fixed-size stack buffer without proper length validation, enabling overwrite of the saved return address or adjacent stack data. The CPE strings cpe:2.3:a:tenda:hg7hg9 and cpe:2.3:a:tenda:hg10 identify the two affected device families, both running firmware build 300001138_en_xpon. These devices are typically deployed as customer-premise equipment by ISPs for fiber broadband subscribers, often with administrative web interfaces exposed on the LAN and, in some misconfigurations, on the WAN side.
RemediationAI
No vendor-released patch identified at time of analysis - Tenda has not published an advisory or fixed firmware build for HG7HG9 or HG10 300001138_en_xpon in the provided references. Operators should monitor https://www.tenda.com.cn/ for an updated firmware release and apply it as soon as available. As compensating controls, disable the WAN-side administrative web interface so /boaform/formDOMAINBLK is unreachable from the internet (this prevents remote field provisioning but eliminates external exposure), restrict LAN access to the management interface via ACL to a dedicated management VLAN or jump host (this breaks casual user access to router admin), and block inbound TCP 80/443 to the device at the upstream firewall. ISPs managing fleets should consider TR-069/ACS-side filtering of suspicious blkDomain payload patterns. Track the public POC at https://github.com/ssaaaa1234/Tenda-HG10-formDOMAINBLK-stack-overflow-2 to validate detection signatures.
Remote code execution and device takeover in the Tenda HG10 (firmware build 300001138) is possible through a stack buffe
Remote unauthenticated buffer overflow in Tenda HG10 firmware 300001138 allows network attackers to corrupt memory and l
OS command injection in Tenda HG10 GPON router firmware 300001138 allows authenticated network attackers to execute arbi
Pre-authentication remote buffer overflow in Tenda HG10 router firmware version 300001138 allows unauthenticated network
Buffer overflow in the Tenda HG10 router (firmware version 300001138) via the `formWanRedirect` function allows a networ
Stack-based buffer overflow in Tenda HG7, HG9, and HG10 XPON ONT routers (firmware 300001138_en_xpon) allows authenticat
Buffer overflow in Tenda HG10 router firmware version 300001138 enables network-accessible authenticated attackers to ov
Stack-based buffer overflow in Tenda HG7, HG9, and HG10 ONT/router devices (firmware 300001138_en_xpon) allows authentic
Same weakness CWE-121 – Stack-based Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today