Which versions of Tenda HG7/HG9/HG10 are affected by CVE-2026-11553?

Tenda XPON ONT routers (HG7, HG9, HG10 running firmware 300001138_en_xpon) contain a stack-based buffer overflow vulnerability with publicly available exploit code, creating immediate operational…

Is there a public PoC exploit available for CVE-2026-11553?

Yes, a public proof-of-concept exploit is available for CVE-2026-11553. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-11553?

Within 24 hours: complete inventory of all Tenda HG7, HG9, HG10 routers and isolate affected units with firmware 300001138_en_xpon; restrict administrative network access to these devices. Within 7 days: implement firewall rules blocking access to /boaform/formPPPEdit endpoint from untrusted networks; disable remote PPP configuration management capabilities where operationally feasible; deploy network-based intrusion detection signatures targeting buffer overflow patterns in the encodename parameter. Within 30 days: contact Tenda Technical Support for patched firmware timeline; develop device replacement or upgrade strategy; establish continuous monitoring for configuration anomalies on remaining affected units.

Tenda HG7/HG9/HG10 CVE-2026-11553

Q: What is the CVSS score of CVE-2026-11553?

CVE-2026-11553 has a CVSS 4.0 base score of 7.4 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-35175 HIGH

Stack-based Buffer Overflow (CWE-121)

2026-06-08 VulDB

GHSA-wf5q-f55f-rq8w

Buffer Overflow Stack Overflow Tenda Hg10 Hg7Hg9

7.4

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

7.4 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 18:31 vuln.today

CVSS changed

Jun 08, 2026 - 18:22 NVD

8.8 (HIGH) 7.4 (HIGH)

DescriptionCVE.org

A vulnerability was found in Tenda HG7HG9 and HG10 300001138_en_xpon. This affects the function formPPPEdit of the file /boaform/formPPPEdit. The manipulation of the argument encodename results in stack-based buffer overflow. The attack can be launched remotely. The exploit has been made public and could be used.

AnalysisAI

Stack-based buffer overflow in Tenda HG7, HG9, and HG10 XPON ONT routers (firmware 300001138_en_xpon) allows authenticated remote attackers to corrupt memory via the encodename parameter of the formPPPEdit handler at /boaform/formPPPEdit. Publicly available exploit code exists (hosted on GitHub by researcher xiezhihua-1127), elevating practical risk despite no confirmed active exploitation in CISA KEV. Successful exploitation yields high impact to confidentiality, integrity, and availability on the affected device.

Technical ContextAI

The affected devices are XPON (10-Gigabit Passive Optical Network) Optical Network Terminals (ONTs) from Tenda, which serve as the customer-premises bridge between an ISP's fiber network and the home/SMB LAN. The vulnerability resides in the embedded HTTP administration interface (the BOA-derived web server, indicated by the /boaform/ URI prefix common to many Chinese consumer router firmwares), specifically in the formPPPEdit CGI handler that processes PPPoE connection edits. The root cause is CWE-121 (Stack-based Buffer Overflow): user-controlled input from the 'encodename' POST/GET argument is copied into a fixed-size stack buffer without bounds checking, enabling adjacent stack memory and the saved return address to be overwritten. On MIPS/ARM-based embedded Linux devices like these, such corruption typically leads to control of the program counter and code execution in the context of the web server (often root).

RemediationAI

No vendor-released patch identified at time of analysis - Tenda has not published a firmware update or advisory addressing CVE-2026-11553 at https://www.tenda.com.cn/. As compensating controls, operators should restrict access to the web management interface to trusted management VLANs only (blocking TCP/80 and TCP/443 from WAN and untrusted LAN segments), change default administrative credentials to break the PR:L precondition, and disable remote management features if not required (side effect: loss of off-LAN administration). Where feasible, place affected ONTs behind an upstream filtering router that blocks POST requests to /boaform/formPPPEdit from unauthorized source IPs; this preserves local admin access but breaks the attack surface. Monitor https://vuldb.com/vuln/369163 and the Tenda support site for firmware updates and replace the device with a supported model if no fix materializes.