Which versions of Tenda HG10 are affected by CVE-2026-6988?

CVE-2026-6988 is a high-severity remote code execution vulnerability affecting Tenda HG10 routers that allows authenticated attackers to achieve complete device compromise through a buffer overflow…

Is there a public PoC exploit available for CVE-2026-6988?

Yes, a public proof-of-concept exploit is available for CVE-2026-6988. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-6988?

Within 24 hours: Identify and inventory all Tenda HG10 routers running firmware HG7_HG9_HG10re_300001138_en_xpon or earlier versions via network scans and asset management systems. Within 7 days: Restrict network access to affected router administration interfaces using firewall rules, implement network segmentation to isolate affected devices, and disable remote management capabilities where feasible. Within 30 days: Monitor Tenda security advisories for firmware patches; if unavailable, evaluate replacement with alternative router hardware from vendors with active security support.

Tenda HG10 CVE-2026-6988

Q: What is the CVSS score of CVE-2026-6988?

CVE-2026-6988 has a CVSS 4.0 base score of 7.4 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-25664 HIGH

Classic Buffer Overflow (CWE-120)

2026-04-25 VulDB

Buffer Overflow Tenda

7.4

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

7.4 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

PoC Detected

Apr 30, 2026 - 14:10 vuln.today

Public exploit code

Re-analysis Queued

Apr 25, 2026 - 18:22 vuln.today

cvss_changed

CVSS changed

Apr 25, 2026 - 18:22 NVD

8.8 (HIGH) 7.4 (HIGH)

Analysis Generated

Apr 25, 2026 - 18:00 vuln.today

EUVD ID Assigned

Apr 25, 2026 - 17:45 euvd

EUVD-2026-25664

Analysis Generated

Apr 25, 2026 - 17:45 vuln.today

CVE Published

Apr 25, 2026 - 17:00 nvd

HIGH 7.4

DescriptionCVE.org

A flaw has been found in Tenda HG10 HG7_HG9_HG10re_300001138_en_xpon. This issue affects the function formRoute of the file /boaform/formRouting of the component Boa Service. This manipulation of the argument nextHop causes buffer overflow. It is possible to initiate the attack remotely. The exploit has been published and may be used.

AnalysisAI

Remote authenticated attackers can execute arbitrary code on Tenda HG10 routers (firmware HG7_HG9_HG10re_300001138_en_xpon) by sending a malformed 'nextHop' parameter to the /boaform/formRouting endpoint in the Boa web service. This buffer overflow vulnerability has publicly available exploit code on GitHub and is rated 8.8 (High) with low attack complexity. EPSS data unavailable; not currently listed in CISA KEV. Successful exploitation requires only low-privilege authentication and grants full device compromise (confidentiality, integrity, and availability impact).

Technical ContextAI

The vulnerability resides in the Boa web server's formRoute function within the /boaform/formRouting handler used by Tenda HG10 home gateway routers. Boa is a lightweight embedded web server commonly found in IoT devices. The flaw is a classic stack-based buffer overflow (CWE-120) triggered by insufficient input validation of the 'nextHop' routing parameter. When processing routing configuration requests, the application copies user-supplied data into a fixed-size buffer without bounds checking, allowing attackers to overwrite adjacent memory including return addresses. The affected firmware version HG7_HG9_HG10re_300001138_en_xpon appears to cover multiple Tenda home gateway models (HG7, HG9, HG10) sharing common codebase. CPE identifier cpe:2.3:a:tenda:hg10:*:*:*:*:*:*:*:* indicates all versions of HG10 product line may be vulnerable pending vendor confirmation of fixed releases.

RemediationAI

No vendor-released patch identified at time of analysis - Tenda has not published security advisories or updated firmware addressing CVE-2026-6988 in the provided references. Monitor https://www.tenda.com.cn/ for firmware updates. Immediate compensating controls: (1) Change default administrative credentials to strong unique passwords (reduces PR:L attack surface but does not eliminate vulnerability). (2) Disable remote administration and restrict web interface access to trusted local network segments only - configure firewall rules to block WAN-side access to management ports TCP 80/443/8080 (eliminates AV:N vector but impacts legitimate remote management). (3) Place affected devices behind additional network segmentation - isolate on dedicated VLAN with strict ACLs (limits post-exploitation lateral movement but adds network complexity). (4) If routing configuration is static, disable dynamic routing features in firmware interface (may prevent access to vulnerable formRoute function but breaks dynamic routing functionality). (5) Consider hardware replacement with actively-maintained vendor if Tenda does not release patch within reasonable timeframe. Each mitigation trades security improvement against operational impact - evaluate based on device role and threat model.