Which versions of Tenda HG10 are affected by CVE-2026-86167?

Tenda HG10 GPON routers (firmware 300001138) contain a command injection vulnerability exploitable by authenticated users, with publicly available exploit code identified.

Is there a public PoC exploit available for CVE-2026-86167?

Yes, a public proof-of-concept exploit is available for CVE-2026-86167. Prioritise patching immediately. EPSS: 1.6%.

How to fix or mitigate CVE-2026-86167?

Within 24 hours: inventory all Tenda HG10 routers in production and identify those running firmware version 300001138; isolate affected devices from untrusted networks if possible. Within 7 days: restrict administrative access to the router's web interface to trusted IP addresses only using firewall rules or VPN-gated access; implement network segmentation to limit lateral movement if a router is compromised. Within 30 days: continuously monitor vendor advisories from Tenda for patched firmware releases; evaluate replacement with routers from vendors providing active security updates as interim long-term strategy.

Tenda HG10 CVE-2026-86167

Q: What is the CVSS score of CVE-2026-86167?

CVE-2026-86167 has a CVSS 4.0 base score of 8.6 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 1.6%.

EUVD-2026-72055 HIGH

OS Command Injection (CWE-78)

2026-09-06 VulDB

GHSA-w592-pr34-frcq

Command Injection Tenda Hg10

8.6

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

8.6 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.9 CRITICAL

Network-reachable admin endpoint (AV:N/AC:L), requires authentication (PR:L); full OS command execution scopes beyond the process (S:C), yielding complete C/I/A compromise.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

POC Analysis Generated

Sep 06, 2026 - 11:20 vuln.today

Analysis Updated

Sep 06, 2026 - 05:29 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Sep 06, 2026 - 05:22 vuln.today

cvss_changed

Severity Changed

Sep 06, 2026 - 05:22 NVD

CRITICAL HIGH

CVSS changed

Sep 06, 2026 - 05:22 NVD

9.4 (CRITICAL) 8.6 (HIGH)

Analysis Generated

Sep 06, 2026 - 04:59 vuln.today

CVE Published

Sep 06, 2026 - 04:30 cve.org

CRITICAL 9.4

DescriptionCVE.org

A vulnerability was identified in Tenda HG10 300001138. Impacted is the function formgponConf of the file /boaform/admin/formgponConf of the component Boa. The manipulation of the argument fmgpon_loid leads to os command injection. Remote exploitation of the attack is possible. The exploit is publicly available and might be used.

AnalysisAI

OS command injection in Tenda HG10 GPON router firmware 300001138 allows authenticated network attackers to execute arbitrary shell commands on the device by manipulating the fmgpon_loid parameter in the /boaform/admin/formgponConf endpoint served by the Boa embedded web server. The fmgpon_loid argument (GPON Line OID) is passed unsanitized to a system call (CWE-78), giving an attacker full control over the underlying Linux OS. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Persist

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Persist

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Exploitation requires the attacker to authenticate to the Boa-based admin web interface (PR:L per CVSS 4.0 vector), meaning valid administrative credentials for the Tenda HG10 management panel are a prerequisite. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 4.0 base score of 8.6 (AV:N/AC:L/AT:N/PR:L/UI:N with VC:H/VI:H/VA:H/SC:H/SI:H/SA:H) signals high severity with both vulnerable-system and subsequent-system impacts rated high, reflecting full device compromise and potential lateral movement into the home/ISP network. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	No vendor-released patch has been identified at time of analysis; the references point only to VulDB entries and the researcher's PoC, with no Tenda security advisory or fixed firmware version listed. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours: inventory all Tenda HG10 routers in production and identify those running firmware version 300001138; isolate affected devices from untrusted networks if possible. …

Threat intelligence, references, and detailed analysis are available after sign-in.