Tenda HG10 CVE-2026-82542

Exploitation requires reaching the HG10's Boa web server and sending a request to the specific endpoint /boaform/admin/formIPv6Routing with an overlong destNet parameter. The supplied CVSS vector states AV:N/AC:L/PR:N/UI:N (no authentication or user interaction), but the /admin/ path strongly implies the handler may sit behind an authenticated admin session - this must be verified against firmware build 300001138, because if a login is required, exploitation is limited to authenticated or LAN-resident attackers. The primary limiting factor is network exposure: HG10 management interfaces are typically LAN-facing and not reachable from the Internet unless remote administration is deliberately enabled, so realistic attackers are on the local network or leveraging an already-authenticated admin. Affected build is 300001138 (other versions unconfirmed).

The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N, all vulnerable- and subsequent-system impacts High, E:P) yields 9.3 and models an unauthenticated, low-complexity, network-reachable full compromise, which combined with public exploit code makes this a genuine priority for any exposed HG10. Two signals temper that: the vulnerable endpoint lives under /boaform/admin/, which on many Tenda/Boa devices sits behind session authentication, so the PR:N (unauthenticated) claim conflicts with the path semantics and should be verified against the actual firmware - if auth is required, real-world risk drops toward that of an authenticated LAN-side attack. The E:P (Proof-of-Concept) exploit maturity and absence from CISA KEV mean code exists but weaponized in-the-wild campaigns are not confirmed; no EPSS score was provided to gauge exploitation likelihood. Because HG10 management interfaces are usually LAN-facing rather than WAN-exposed by default, the practical attack surface for most deployments is an attacker already on the local network or one that has lured a logged-in admin, and any operator running these units should still treat public-exploit-plus-critical-CVSS as urgent and patch or restrict management access promptly.

An attacker with network reach to an HG10's web interface - either an adversary on the same LAN/Wi-Fi or, if management is WAN-exposed, a remote attacker - sends a crafted HTTP POST to /boaform/admin/formIPv6Routing with an overlong destNet value. The oversized argument overflows the stack buffer in the Boa handler, crashing the router (denial of service) or, with a tuned payload, executing attacker code on the device. A public PoC for this exact endpoint and parameter already exists, lowering the effort required to reproduce the crash.