EUVD-2026-35029
GHSA-xv62-77m9-3736
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify exposed Tenda HG router
-
DeliverySend crafted POST to /boaform/formDOMAINBLK
-
ExploitOversized blkDomain overflows stack buffer
-
ExecutionOverwrite saved return address
-
PersistExecute shellcode as root
-
ImpactInstall persistent backdoor or botnet implant
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Stack buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The attacker needs network reachability to the device's HTTP management interface exposing the /boaform/formDOMAINBLK endpoint on Tenda HG7HG9 or HG10 running firmware 300001138_en_xpon; no authentication, user interaction, or non-default configuration is required per the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N). The practical limiting factor is whether the boa web interface is exposed to the attacker's network position - on standard ISP deployments the admin UI is LAN-only, so remote internet exploitation requires the device to have WAN-side admin enabled (a non-default but common ISP provisioning choice) or the attacker to already be on the subscriber's LAN. |
| Impact | The CVSS 4.0 vector AV:N/AC:L/AT:N/PR:N/UI:N is the worst-case profile - network reachable, low complexity, no authentication, no user interaction - and high impact across CIA, justifying the 9.3 base score. A public proof-of-concept on GitHub materially raises real-world risk versus a theoretical advisory. EPSS and CISA KEV status were not provided in the input, so probabilistic exploitation likelihood and confirmed active exploitation cannot be cited; absence is not evidence of safety, particularly for SOHO router buffer overflows which historically attract botnet operators (Mirai-style). Mitigating factors: the management endpoint /boaform is generally LAN-facing on default ONT deployments, so internet-wide mass exploitation depends on how many ISPs expose the web UI to the WAN. Net assessment: real priority for any operator with these devices in the fleet, especially if the WAN-side admin interface is enabled. |
| Exploit ScenarioDerived | An attacker reachable on the network path to the router's web interface sends a single crafted HTTP POST to /boaform/formDOMAINBLK with an oversized blkDomain parameter, overflowing the stack buffer in the boa server process. A publicly available exploit code exists on GitHub, lowering the skill barrier; successful exploitation can crash the device (denial of service) or, with proper ROP/shellcode tailored to the MIPS/ARM firmware, yield code execution as the web server user - typically root on embedded routers - enabling persistent backdoor implantation or recruitment into a botnet. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 08, 2026
Stack-based buffer overflow in Tenda HG7HG9 and HG10 routers (firmware 300001138_en_xpon) allows remote attackers to corrupt memory via the blkDomain parameter in the formDOMAINBLK handler at /boaform/formDOMAINBLK. The CVSS 4.0 score of 9.3 reflects network-reachable, unauthenticated exploitation with high impact to confidentiality, integrity, and availability, and a public proof-of-concept repository has been published on GitHub by researcher ssaaaa1234, though no public exploit has been confirmed as active exploitation.
RemediationAI
No vendor-released patch identified at time of analysis - Tenda has not published an advisory or fixed firmware build for HG7HG9 or HG10 300001138_en_xpon in the provided references. Operators should monitor https://www.tenda.com.cn/ for an updated firmware release and apply it as soon as available. As compensating controls, disable the WAN-side administrative web interface so /boaform/formDOMAINBLK is unreachable from the internet (this prevents remote field provisioning but eliminates external exposure), restrict LAN access to the management interface via ACL to a dedicated management VLAN or jump host (this breaks casual user access to router admin), and block inbound TCP 80/443 to the device at the upstream firewall. ISPs managing fleets should consider TR-069/ACS-side filtering of suspicious blkDomain payload patterns. Track the public POC at https://github.com/ssaaaa1234/Tenda-HG10-formDOMAINBLK-stack-overflow-2 to validate detection signatures.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerable component is the boa web server's formDOMAINBLK handler, used for domain blocking/filtering configuration on Tenda HG-series xPON ONT (optical network termination) gateways. CWE-121 (stack-based buffer overflow) indicates the blkDomain argument is copied into a fixed-size stack buffer without proper length validation, enabling overwrite of the saved return address or adjacent stack data. The CPE strings cpe:2.3:a:tenda:hg7hg9 and cpe:2.3:a:tenda:hg10 identify the two affected device families, both running firmware build 300001138_en_xpon. These devices are typically deployed as customer-premise equipment by ISPs for fiber broadband subscribers, often with administrative web interfaces exposed on the LAN and, in some misconfigurations, on the WAN side.
Know when Hg7Hg9 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
Lifecycle Timeline
1DescriptionCVE.org
A vulnerability was determined in Tenda HG7HG9 and HG10 300001138_en_xpon. This affects the function formDOMAINBLK of the file /boaform/formDOMAINBLK. Executing a manipulation of the argument blkDomain can lead to stack-based buffer overflow. The attack may be performed from remote.
Executive ViewAI
Tenda HG7HG9 and HG10 routers (firmware 300001138_en_xpon) contain a critical remote buffer overflow vulnerability that allows unauthenticated attackers to completely compromise router integrity and network security without user interaction. This affects any organization using these models as network access points, with publicly available proof-of-concept code increasing the risk of near-term exploitation against exposed devices.
No vendor-released patch identified at time of analysis. Interim mitigations: implement network segmentation to isolate affected routers, disable remote management interfaces (restrict /boaform endpoints to internal networks only), enable egress filtering on affected devices, deploy intrusion detection rules monitoring for buffer overflow attack patterns targeting blkDomain parameter, and increase monitoring of router logs for suspicious activity. These controls reduce but do not eliminate risk-replacement is mandatory.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than it was allocated to hold.
Stack-based buffer overflow in Tenda HG7, HG9, and HG10 XPON ONT routers (firmware 300001138_en_xpon) allows authenticat
Stack-based buffer overflow in Tenda HG7, HG9, and HG10 ONT/router devices (firmware 300001138_en_xpon) allows authentic
Exploit-DB