Tenda HG7/HG9/HG10 EUVD-2026-35028

The attacker must (1) have network reachability to the device Web Management Interface - typically the LAN side, or the WAN side if the ISP has not firewalled management ports; (2) hold valid low-privilege Web Management Interface credentials, as the CVSS vector specifies PR:L (authentication is required, not bypassed); (3) target a device running the specific Tenda HG7, HG9, or HG10 firmware build 300001138_en_xpon, since other firmware revisions are not confirmed vulnerable in available data; and (4) reach the specific endpoint /boaform/voip_other_set, which is part of the VoIP configuration surface and is present in default configurations of these ONT devices. No user interaction is required (UI:N), and attack complexity is low (AC:L) - once authenticated, sending the malformed funckey_transfer parameter is sufficient.

The CVSS 4.0 vector AV:N/AC:L/AT:N/PR:L/UI:N with VC:H/VI:H/VA:H indicates network-reachable, low-complexity exploitation requiring low privileges and no user interaction, producing full compromise of the device - a justifiably high 8.7 score. A public proof-of-concept repository on GitHub (ssaaaa1234/tenda-hg10-voip-other-set-stack-overflow) increases practical exploitability beyond the raw CVSS reading. EPSS score was not provided in the input data and the CVE is not listed in CISA KEV at time of analysis, so widespread active exploitation cannot be confirmed; however, Tenda CPE devices have a strong history of being absorbed into IoT botnets shortly after PoC publication, so absence-of-evidence should not be read as evidence-of-absence. The PR:L requirement materially constrains opportunistic Internet-wide exploitation, but ISP-deployed ONTs frequently ship with weak or default subscriber/admin credentials, effectively collapsing the authentication barrier in practice.

An attacker who has obtained low-privilege Web Management Interface credentials - often trivial on ISP-distributed ONTs with shared or default subscriber passwords - sends a crafted HTTP POST to /boaform/voip_other_set containing an oversized funckey_transfer value, overflowing the stack buffer in asp_voip_OtherSet and overwriting the saved return address. The public PoC at github.com/ssaaaa1234/tenda-hg10-voip-other-set-stack-overflow demonstrates the trigger, lowering the skill bar to weaponization. Successful exploitation yields code execution in the context of the web daemon, typically root on embedded Boa servers, enabling persistent backdooring, traffic interception of VoIP/SIP credentials, or recruitment into an IoT botnet.