Tenda HG10 CVE-2026-6988

Requires low-privilege authenticated access to the Tenda HG10 web administration interface (CVSS PR:L). Specifically, attackers must successfully authenticate to the Boa web service - typically accessible via default credentials that ship with consumer routers and are frequently unchanged by end users. The vulnerable /boaform/formRouting endpoint must be network-accessible, which is standard in default configurations where the web interface listens on LAN (always) and often WAN (if remote management enabled). No additional non-default configuration, specific feature enablement, or user interaction required beyond initial authentication. Attack is not limited by platform - affects all devices running the identified firmware version HG7_HG9_HG10re_300001138_en_xpon. The buffer overflow triggers during normal routing configuration operations, meaning the vulnerable code path executes as part of intended administrative functionality.

This vulnerability presents HIGH real-world risk despite requiring authentication. CVSS 8.8 with vector AV:N/AC:L/PR:L/UI:N indicates network-accessible exploitation with low complexity requiring only low-privilege credentials - typically default or easily-guessed router admin passwords on consumer devices. The E:P (Exploit Proof-of-Concept) temporal metric is confirmed by GitHub POC availability at https://github.com/xyh4ck/iot_poc/blob/main/Tenda/HG10/01_Buffer_Overflow_nextHop/README.md, significantly lowering exploitation barriers. Home routers often retain default credentials and rarely receive firmware updates, creating persistent attack surface. Complete impact triad (C:H/I:H/A:H) means full device compromise: attackers gain root-level code execution enabling network pivoting, traffic interception, botnet enrollment, or denial of service. Not currently in CISA KEV suggests targeted rather than mass exploitation, but public POC availability makes widespread exploitation feasible. Primary risk factors: consumer device with poor credential hygiene, embedded system unlikely to receive patches, and publicly documented exploitation method. Mitigating factors: requires authenticated access (though PR:L is weak barrier on IoT devices) and appears limited to specific Tenda product line rather than widespread library vulnerability.

An attacker on the internet identifies a Tenda HG10 router with default credentials (admin/admin) exposed via port forwarding or UPnP. They authenticate to the web interface, then send a crafted POST request to /boaform/formRouting containing an oversized 'nextHop' parameter exceeding buffer boundaries. The malicious payload overwrites the stack return address, redirecting execution to attacker-controlled shellcode. With root privileges on the router, the attacker installs persistent backdoor access, harvests credentials from network traffic, and uses the compromised gateway as a pivot point to attack internal network hosts.