Tenda HG10 CVE-2026-85109

No special conditions - remote unauthenticated exploitation against default configurations of Tenda HG10 firmware 300001138. The login form endpoint /boaform/formLogin is active by default on the Boa Web Server and requires no prior authentication. The only practical limiting factor is network reachability: if the management interface is bound exclusively to the LAN interface and WAN-side remote management is disabled (common but not universal default), the attack surface is reduced to LAN-adjacent attackers. WAN exposure depends on ISP NAT configuration and user settings. No specific feature flag or non-default configuration is required to trigger the vulnerability.

Risk is elevated by the confluence of multiple high-severity signals: the CVSS 4.0 base vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H) confirms unauthenticated remote exploitation with no user interaction and full impact across all three security properties. A public PoC is available on GitHub (bof-formLogin_username.md), which for embedded devices with no patching mechanism is a near-immediate weaponization risk. Tenda SOHO routers frequently expose their management interface to the LAN and, in some configurations, the WAN, making this broadly reachable. No KEV listing has been identified at time of analysis, so confirmed active exploitation is not established, but the combination of a trivial, unauthenticated attack path and a working PoC makes opportunistic scanning and exploitation highly likely. EPSS data was not provided; given the PoC status, real-world exploitation probability is assessed as elevated. Embedded devices in this class typically cannot be patched by end users without a vendor firmware update, which Tenda has not publicly confirmed.

An attacker scans the internet for Tenda HG10 routers with the Boa server port accessible (typically TCP 80 or 8080). Using the publicly disclosed PoC at the GitHub repository, the attacker crafts an HTTP POST to /boaform/formLogin containing a Username field padded to overflow the fixed-size buffer, overwriting the return address. Because Boa runs as root on the embedded firmware with no stack-canary protection, this yields unauthenticated remote root code execution - allowing the attacker to install persistent malware, pivot to LAN hosts, or enlist the device in a botnet.