Which versions of Tenda HG7/HG9/HG10 are affected by EUVD-2026-35028?

Tenda HG7, HG9, and HG10 router devices contain a stack-based buffer overflow vulnerability allowing authenticated users to corrupt device memory and disrupt network connectivity and data integrity.

How to fix or mitigate EUVD-2026-35028?

Within 24 hours: Inventory all affected Tenda HG7, HG9, HG10 devices (firmware 300001138_en_xpon). Within 7 days: Restrict Web Management Interface access to trusted networks only, disable remote management if unused, and strengthen administrative access controls. Within 30 days: Evaluate device replacement options; monitor Tenda security advisories for patch availability; consider alternative routing solutions.

Tenda HG7/HG9/HG10 EUVD-2026-35028

Q: What is the CVSS score of EUVD-2026-35028?

EUVD-2026-35028 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

| CVE-2026-11498 HIGH

Stack-based Buffer Overflow (CWE-121)

2026-06-08 VulDB

GHSA-5pcp-w822-8j6f

Tenda Stack Overflow Buffer Overflow

8.7

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 10:36 vuln.today

CVSS changed

Jun 08, 2026 - 09:22 NVD

8.8 (HIGH) 8.7 (HIGH)

DescriptionCVE.org

A vulnerability was found in Tenda HG7HG9 and HG10 300001138_en_xpon. Affected by this issue is the function asp_voip_OtherSet of the file /boaform/voip_other_set of the component Web Management Interface. Performing a manipulation of the argument funckey_transfer results in stack-based buffer overflow. The attack is possible to be carried out remotely.

AnalysisAI

Stack-based buffer overflow in Tenda HG7, HG9, and HG10 ONT/router devices (firmware 300001138_en_xpon) allows authenticated remote attackers to corrupt memory by manipulating the funckey_transfer parameter sent to the /boaform/voip_other_set endpoint handled by the asp_voip_OtherSet function. Publicly available exploit code exists via a dedicated GitHub proof-of-concept repository, and the flaw scores CVSS 4.0 8.7 with full confidentiality, integrity, and availability impact. No public exploit identified in CISA KEV at time of analysis, but exposure of the Web Management Interface to untrusted networks materially raises real-world risk.

Technical ContextAI

The affected devices are Tenda HG7, HG9, and HG10 GPON/XPON optical network terminals (ONT) running firmware build 300001138_en_xpon, which expose a Boa-based Web Management Interface for subscriber and VoIP configuration. The vulnerable code path is the asp_voip_OtherSet handler bound to /boaform/voip_other_set, which processes VoIP 'other settings' including the funckey_transfer parameter used to configure call transfer feature codes. CWE-121 (Stack-based Buffer Overflow) indicates the handler copies user-supplied input into a fixed-size stack buffer without proper bounds checking, typical of unsafe strcpy/sprintf usage common in embedded CGI binaries on Boa servers. Successful overflow corrupts the saved return address or adjacent stack data, enabling control-flow hijack on MIPS/ARM-class SoCs commonly used in Tenda CPE devices, with CPE identifiers cpe:2.3:a:tenda:hg7hg9 and cpe:2.3:a:tenda:hg10 confirming the affected product line.

RemediationAI

No vendor-released patch identified at time of analysis - Tenda has not published a fixed firmware version for the 300001138_en_xpon build in the available references. As compensating controls, restrict access to the device Web Management Interface so that the /boaform/ tree is reachable only from the LAN-side management VLAN and explicitly block WAN-side TCP/80 and TCP/443 to the CPE (this is standard ISP hardening and has no impact on subscriber data traffic). Where the device is ISP-managed, rotate any default or shared subscriber/admin credentials immediately to raise the PR:L barrier into a meaningful obstacle, and where supported deploy an ACL on the upstream OLT to drop unsolicited management-plane traffic toward ONT IPs. Monitor for POST requests to /boaform/voip_other_set with oversized funckey_transfer values as a detection signal, and track the vendor portal at https://www.tenda.com.cn/ and VulDB entry https://vuldb.com/vuln/369118 for firmware availability.