Which versions of Tenda HG10 are affected by CVE-2026-11499?

Tenda HG7HG9 and HG10 routers (firmware 300001138_en_xpon) contain a critical remote buffer overflow vulnerability that allows unauthenticated attackers to completely compromise router integrity and…

How to fix or mitigate CVE-2026-11499?

24 hours: Conduct asset inventory to identify all Tenda HG7HG9 and HG10 routers deployed; disable WAN access to affected devices and restrict management interfaces to trusted networks only. 7 days: Procure replacement routers and establish transition timeline; coordinate with network operations to schedule replacements. 30 days: Complete replacement of all affected Tenda models with patched alternatives or equivalent hardware from vendors with current security support.

Tenda HG10 CVE-2026-11499

Q: What is the CVSS score of CVE-2026-11499?

CVE-2026-11499 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-35029 CRITICAL

Stack-based Buffer Overflow (CWE-121)

2026-06-08 VulDB

GHSA-xv62-77m9-3736

Tenda Stack Overflow Buffer Overflow

9.3

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 10:35 vuln.today

CVSS changed

Jun 08, 2026 - 09:22 NVD

9.8 (CRITICAL) 9.3 (CRITICAL)

DescriptionCVE.org

A vulnerability was determined in Tenda HG7HG9 and HG10 300001138_en_xpon. This affects the function formDOMAINBLK of the file /boaform/formDOMAINBLK. Executing a manipulation of the argument blkDomain can lead to stack-based buffer overflow. The attack may be performed from remote.

AnalysisAI

Stack-based buffer overflow in Tenda HG7HG9 and HG10 routers (firmware 300001138_en_xpon) allows remote attackers to corrupt memory via the blkDomain parameter in the formDOMAINBLK handler at /boaform/formDOMAINBLK. The CVSS 4.0 score of 9.3 reflects network-reachable, unauthenticated exploitation with high impact to confidentiality, integrity, and availability, and a public proof-of-concept repository has been published on GitHub by researcher ssaaaa1234, though no public exploit has been confirmed as active exploitation.

Technical ContextAI

The vulnerable component is the boa web server's formDOMAINBLK handler, used for domain blocking/filtering configuration on Tenda HG-series xPON ONT (optical network termination) gateways. CWE-121 (stack-based buffer overflow) indicates the blkDomain argument is copied into a fixed-size stack buffer without proper length validation, enabling overwrite of the saved return address or adjacent stack data. The CPE strings cpe:2.3:a:tenda:hg7hg9 and cpe:2.3:a:tenda:hg10 identify the two affected device families, both running firmware build 300001138_en_xpon. These devices are typically deployed as customer-premise equipment by ISPs for fiber broadband subscribers, often with administrative web interfaces exposed on the LAN and, in some misconfigurations, on the WAN side.

RemediationAI

No vendor-released patch identified at time of analysis - Tenda has not published an advisory or fixed firmware build for HG7HG9 or HG10 300001138_en_xpon in the provided references. Operators should monitor https://www.tenda.com.cn/ for an updated firmware release and apply it as soon as available. As compensating controls, disable the WAN-side administrative web interface so /boaform/formDOMAINBLK is unreachable from the internet (this prevents remote field provisioning but eliminates external exposure), restrict LAN access to the management interface via ACL to a dedicated management VLAN or jump host (this breaks casual user access to router admin), and block inbound TCP 80/443 to the device at the upstream firewall. ISPs managing fleets should consider TR-069/ACS-side filtering of suspicious blkDomain payload patterns. Track the public POC at https://github.com/ssaaaa1234/Tenda-HG10-formDOMAINBLK-stack-overflow-2 to validate detection signatures.