Tenda HG10 CVE-2026-86165

The CVSS 4.0 vector (PR:N/UI:N/AC:L/AT:N) indicates no authentication, no user interaction, and no special configuration is required. Exploitation requires network-level access to the Boa HTTP admin interface on the HG10 - typically port 80 on the LAN interface, and potentially the WAN interface if remote management is enabled (a non-default but common misconfiguration on consumer Tenda devices). The specific endpoint /boaform/admin/formURL and the parameters Keywd or urlFQDN must be reachable. Limiting factors: devices where the admin interface is firewalled to LAN-only and remote management is explicitly disabled are not reachable from the internet, constraining exploitation to local network attackers. No authentication bypass is needed if the endpoint is already unauthenticated, as reflected in PR:N.

The CVSS 4.0 base vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H) scores 8.9, reflecting unauthenticated network exploitation with full CIA impact and no special preconditions. The E:P (proof-of-concept exists) supplemental metric compounds this - a working PoC is publicly hosted on GitHub targeting this exact function and parameters, substantially lowering the skill bar for exploitation. No CISA KEV listing is present, so confirmed in-the-wild mass exploitation is not established, but PoC availability on a widely indexed repository makes opportunistic scanning likely. The wildcard CPE version suggests Tenda has not released a fixed firmware, meaning there is no vendor-confirmed remediation path. EPSS data is not provided in the input; the combination of PoC availability and no patch likely places this in a high-urgency category for defenders with exposed HG10 devices. The admin-facing endpoint path (/boaform/admin/) may imply LAN-side access in hardened deployments, but the PR:N CVSS metric and the nature of Tenda consumer firmware suggest authentication is not enforced on this handler.

An unauthenticated attacker on the network (or internet, if the admin interface is WAN-exposed) sends a crafted HTTP POST request to /boaform/admin/formURL with an excessively long Keywd or urlFQDN parameter value. The formURL function copies the oversized string into a fixed-size stack buffer without bounds checking, corrupting the return address or adjacent control data. The attacker leverages the publicly available PoC to achieve arbitrary code execution as root on the HG10 device, enabling full device compromise including traffic interception, credential harvesting, and pivoting into the LAN.