EUVD-2026-70471
GHSA-f4xv-q254-wwpm
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable Boa endpoint requires valid credentials (PR:L); no interaction needed; buffer overflow yields full device compromise with no scope change.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
6DescriptionCVE.org
A vulnerability was identified in Tenda HG10 300001138. Impacted is the function formWlanSetup of the file /boaform/formWlanSetup of the component Boa Web Server. The manipulation of the argument ssid leads to buffer overflow. Remote exploitation of the attack is possible. The exploit is publicly available and might be used.
AnalysisAI
Buffer overflow in Tenda HG10 router firmware version 300001138 enables network-accessible authenticated attackers to overflow memory in the Boa embedded web server's WLAN configuration handler, potentially achieving arbitrary code execution. The vulnerable parameter is ssid within the /boaform/formWlanSetup endpoint, which lacks input length validation per CWE-120. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires network access to the Tenda HG10's Boa web management interface and possession of valid management credentials (confirmed PR:L in the CVSS 4.0 vector). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H) characterizes this as a low-complexity, network-reachable exploit requiring only low-level credentials, with full impact on the vulnerable device. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch has been identified at time of analysis; users should monitor https://www.tenda.com.cn/ for firmware updates targeting CVE-2026-85110. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Identify and inventory all Tenda HG10 devices running firmware version 300001138; verify administrative access logs for unauthorized login attempts or exploitation attempts targeting the /boaform/formWlanSetup endpoint. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Remote code execution and device takeover in the Tenda HG10 (firmware build 300001138) is possible through a stack buffe
Remote unauthenticated buffer overflow in Tenda HG10 firmware 300001138 allows network attackers to corrupt memory and l
OS command injection in Tenda HG10 GPON router firmware 300001138 allows authenticated network attackers to execute arbi
Pre-authentication remote buffer overflow in Tenda HG10 router firmware version 300001138 allows unauthenticated network
Buffer overflow in the Tenda HG10 router (firmware version 300001138) via the `formWanRedirect` function allows a networ
Stack-based buffer overflow in Tenda HG7, HG9, and HG10 XPON ONT routers (firmware 300001138_en_xpon) allows authenticat
Stack-based buffer overflow in Tenda HG7HG9 and HG10 routers (firmware 300001138_en_xpon) allows remote attackers to cor
Stack-based buffer overflow in Tenda HG7, HG9, and HG10 ONT/router devices (firmware 300001138_en_xpon) allows authentic
Same weakness CWE-120 – Classic Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today