Skip to main content

Tenda HG10 CVE-2026-6988

| EUVD-2026-25664 HIGH
Classic Buffer Overflow (CWE-120)
2026-04-25 VulDB
Buffer Overflow Tenda
7.4
CVSS 4.0
Share

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
X

Lifecycle Timeline

7
PoC Detected
Apr 30, 2026 - 14:10 vuln.today
Public exploit code
Re-analysis Queued
Apr 25, 2026 - 18:22 vuln.today
cvss_changed
CVSS changed
Apr 25, 2026 - 18:22 NVD
8.8 (HIGH) 7.4 (HIGH)
Analysis Generated
Apr 25, 2026 - 18:00 vuln.today
EUVD ID Assigned
Apr 25, 2026 - 17:45 euvd
EUVD-2026-25664
Analysis Generated
Apr 25, 2026 - 17:45 vuln.today
CVE Published
Apr 25, 2026 - 17:00 nvd
HIGH 7.4

DescriptionNVD

A flaw has been found in Tenda HG10 HG7_HG9_HG10re_300001138_en_xpon. This issue affects the function formRoute of the file /boaform/formRouting of the component Boa Service. This manipulation of the argument nextHop causes buffer overflow. It is possible to initiate the attack remotely. The exploit has been published and may be used.

AnalysisAI

Remote authenticated attackers can execute arbitrary code on Tenda HG10 routers (firmware HG7_HG9_HG10re_300001138_en_xpon) by sending a malformed 'nextHop' parameter to the /boaform/formRouting endpoint in the Boa web service. This buffer overflow vulnerability has publicly available exploit code on GitHub and is rated 8.8 (High) with low attack complexity. …

Sign in for full analysis, threat intelligence, and remediation guidance.

RemediationAI

Within 24 hours: Identify and inventory all Tenda HG10 routers running firmware HG7_HG9_HG10re_300001138_en_xpon or earlier versions via network scans and asset management systems. Within 7 days: Restrict network access to affected router administration interfaces using firewall rules, implement network segmentation to isolate affected devices, and disable remote management capabilities where feasible. …

Sign in for detailed remediation steps.

Full analysis requires sign-in

Get intelligence summaries, risk assessment, exploit details, threat intel, and remediation guidance.

Sign in - Free

Share

CVE-2026-6988 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy