EUVD-2026-72050
GHSA-q93p-5wpr-g629
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible Boa server requires low-privileged auth per CVSS 4.0 PR:L; classic buffer overflow yields full device compromise with no scope change.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
4DescriptionCVE.org
A vulnerability was determined in Tenda HG10 300001138. This issue affects the function formWanRedirect of the file /boaform/formWanRedirect of the component Boa Web Server. Executing a manipulation of the argument if can lead to buffer overflow. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized.
AnalysisAI
Buffer overflow in the Tenda HG10 router (firmware version 300001138) via the formWanRedirect function allows a network-authenticated attacker to overwrite control-flow data in the Boa embedded web server process, enabling remote code execution or device crash. The vulnerable endpoint /boaform/formWanRedirect fails to validate the length of the if argument before copying it into a fixed-size buffer (CWE-120). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires network-reachable access to the Boa HTTP server on the Tenda HG10 and a low-privileged authenticated session (PR:L per the CVSS 4.0 vector), meaning a valid web interface credential is needed to reach the `/boaform/formWanRedirect` endpoint. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 7.4 is grounded in a network-reachable, low-complexity attack requiring low privileges (PR:L), with high confidentiality, integrity, and availability impact on the vulnerable system. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch has been identified at time of analysis for the Tenda HG10. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all Tenda HG10 routers running firmware 300001138 in your environment and immediately restrict their network exposure-either by isolating them from untrusted networks or taking them offline if operationally feasible. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Remote code execution and device takeover in the Tenda HG10 (firmware build 300001138) is possible through a stack buffe
Remote unauthenticated buffer overflow in Tenda HG10 firmware 300001138 allows network attackers to corrupt memory and l
Pre-authentication remote buffer overflow in Tenda HG10 router firmware version 300001138 allows unauthenticated network
OS command injection in Tenda HG10 GPON router firmware 300001138 allows authenticated network attackers to execute arbi
Stack-based buffer overflow in Tenda HG7, HG9, and HG10 XPON ONT routers (firmware 300001138_en_xpon) allows authenticat
Buffer overflow in Tenda HG10 router firmware version 300001138 enables network-accessible authenticated attackers to ov
Stack-based buffer overflow in Tenda HG7HG9 and HG10 routers (firmware 300001138_en_xpon) allows remote attackers to cor
Stack-based buffer overflow in Tenda HG7, HG9, and HG10 ONT/router devices (firmware 300001138_en_xpon) allows authentic
Same weakness CWE-120 – Classic Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today