Tenda HG10 CVE-2026-86166

Exploitation requires network-reachable access to the Boa HTTP server on the Tenda HG10 and a low-privileged authenticated session (PR:L per the CVSS 4.0 vector), meaning a valid web interface credential is needed to reach the /boaform/formWanRedirect endpoint. The overflow is triggered by submitting an oversized value in the if argument to that specific form handler. Unauthenticated remote exploitation is not supported by the CVSS vector. Devices with the web management interface exposed on the WAN face the broadest attack surface; devices restricted to LAN-only management access limit exploitation to attackers already on the local network segment or possessing valid credentials.

The CVSS 4.0 score of 7.4 is grounded in a network-reachable, low-complexity attack requiring low privileges (PR:L), with high confidentiality, integrity, and availability impact on the vulnerable system. The publicly available PoC on GitHub meaningfully accelerates the threat timeline - even a mid-sized municipal IT team in gdynia managing ISP-deployed HG10 units should treat this as urgent, given that working exploit code lowers the attacker skill bar substantially. No active exploitation has been confirmed by CISA KEV, so this is classified as 'publicly available exploit code exists' rather than confirmed in-the-wild exploitation. The all-versions CPE wildcard implies no patched firmware is available, leaving all deployed units exposed with no vendor-sanctioned remediation path. EPSS data was not provided in source intelligence; however, the combination of PoC availability, network reachability, and absent patch suggests elevated short-term opportunistic risk, particularly for devices with the management interface exposed on the WAN.

An attacker with low-privileged authenticated access to the Tenda HG10 web interface submits a crafted HTTP POST request to /boaform/formWanRedirect containing an excessively long value in the if parameter. The formWanRedirect handler copies this value into a fixed-size buffer without length validation, overflowing into adjacent memory and overwriting the return address or function pointer within the Boa server process. A public PoC documenting the exact overflow trigger is available on GitHub, enabling straightforward adaptation into functional exploit code targeting the router's embedded architecture.