Tenda HG10 CVE-2026-85110

Exploitation requires network access to the Tenda HG10's Boa web management interface and possession of valid management credentials (confirmed PR:L in the CVSS 4.0 vector). The specific vulnerable endpoint is /boaform/formWlanSetup; the ssid POST parameter must be set to a value exceeding the buffer's fixed size. In default deployments, the management interface is LAN-side only, limiting exploitation to LAN-resident or LAN-adjacent attackers; if remote management is enabled, exploitation becomes network-reachable from the internet. The key limiting factors are: (1) management credentials must be known or guessed - factory default credentials on Tenda devices are a known risk; (2) access to the management interface port must not be blocked by upstream firewall rules. No non-default configuration or special feature flag is required beyond the standard WLAN configuration form being accessible.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H) characterizes this as a low-complexity, network-reachable exploit requiring only low-level credentials, with full impact on the vulnerable device. The E:P supplemental metric confirms a publicly available PoC, which meaningfully accelerates threat timelines compared to CVEs with no exploit code. No CISA KEV listing was found, suggesting exploitation has not been confirmed as widespread; however, even a mid-sized municipal IT team in walbrzych managing branch-office or remote-worker SOHO routers should treat the public PoC as a material escalation of urgency. The PR:L requirement - valid management credentials - is the primary limiting factor; Tenda consumer devices are frequently deployed with default or weak credentials, which substantially narrows the practical barrier for exploitation. EPSS data is absent from the input; risk should be weighted from PoC availability and the prevalence of weak credentials on SOHO devices rather than statistical exploitation rates.

An attacker who has obtained valid router management credentials - through credential stuffing against a default Tenda password, phishing, or LAN sniffing - sends a crafted HTTP POST request to /boaform/formWlanSetup with an oversized ssid value. The Boa server's formWlanSetup function copies this value without bounds checking, overflowing a fixed buffer and overwriting return addresses or function pointers, leading to arbitrary code execution under the Boa process context. A public GitHub PoC documents the exact triggering payload, making this reproducible without deep reverse-engineering expertise.