EUVD-2026-35175
GHSA-wf5q-f55f-rq8w
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
ReconIdentify exposed Tenda XPON ONT
-
DeliveryObtain low-priv web credentials
-
ExploitPOST oversized encodename to /boaform/formPPPEdit
-
InstallOverflow stack buffer and hijack return address
-
C2Execute shellcode as web server (root)
-
ExecuteInstall botnet payload or backdoor
-
ImpactPivot to LAN or join DDoS botnet
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Stack buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network reachability to the device's HTTP administration interface (typically the LAN side, port 80/443, though some ISP deployments expose it on the WAN for TR-069/remote management) and valid low-privileged credentials to the web UI per CVSS PR:L - no user interaction is required (UI:N). The target must be running firmware 300001138_en_xpon on a Tenda HG7, HG9, or HG10 XPON ONT, and the formPPPEdit endpoint at /boaform/formPPPEdit must be reachable by the attacker's session. Limiting factors: the authentication requirement excludes purely opportunistic unauthenticated scanning, but this is materially weakened where default credentials remain unchanged - a common state for consumer ISP-deployed ONTs. |
| Impact | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) indicates network-reachable, low-complexity exploitation requiring low privileges - meaning an attacker needs at least a low-privileged authenticated session, which substantially limits exposure compared to a fully unauthenticated bug. The E:P (Proof-of-Concept) threat metric aligns with the disclosed GitHub exploit, and VC:H/VI:H/VA:H confirms full compromise of the device on success. There is no CISA KEV listing and no EPSS score provided, so widespread automated exploitation cannot be confirmed; however, Tenda consumer devices are routinely targeted by botnets (Mirai variants) and the published PoC lowers the bar significantly. The realistic priority is moderate-to-high for ISPs and operators with these specific XPON ONTs exposed to LAN/WAN management interfaces, particularly where default credentials are unchanged - default credentials would functionally collapse the PR:L requirement. |
| Exploit ScenarioDerived | An attacker who has obtained low-privileged web UI credentials (via phishing, credential reuse, default-password sweeps of internet-exposed ONTs, or LAN-side access) sends a crafted HTTP request to /boaform/formPPPEdit with an oversized encodename parameter, overflowing the stack buffer and overwriting the saved return address. Using the publicly available PoC from github.com/xiezhihua-1127/Tenda-Stack-Overflow as a template, the attacker achieves code execution as the web server process (typically root on these embedded devices), then drops a Mirai-class payload or pivots to the LAN. The realistic large-scale scenario is botnet recruitment of ISP-deployed ONTs that share weak default credentials. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 08, 2026
Stack-based buffer overflow in Tenda HG7, HG9, and HG10 XPON ONT routers (firmware 300001138_en_xpon) allows authenticated remote attackers to corrupt memory via the encodename parameter of the formPPPEdit handler at /boaform/formPPPEdit. Publicly available exploit code exists (hosted on GitHub by researcher xiezhihua-1127), elevating practical risk despite no confirmed active exploitation in CISA KEV. Successful exploitation yields high impact to confidentiality, integrity, and availability on the affected device.
RemediationAI
No vendor-released patch identified at time of analysis - Tenda has not published a firmware update or advisory addressing CVE-2026-11553 at https://www.tenda.com.cn/. As compensating controls, operators should restrict access to the web management interface to trusted management VLANs only (blocking TCP/80 and TCP/443 from WAN and untrusted LAN segments), change default administrative credentials to break the PR:L precondition, and disable remote management features if not required (side effect: loss of off-LAN administration). Where feasible, place affected ONTs behind an upstream filtering router that blocks POST requests to /boaform/formPPPEdit from unauthorized source IPs; this preserves local admin access but breaks the attack surface. Monitor https://vuldb.com/vuln/369163 and the Tenda support site for firmware updates and replace the device with a supported model if no fix materializes.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected devices are XPON (10-Gigabit Passive Optical Network) Optical Network Terminals (ONTs) from Tenda, which serve as the customer-premises bridge between an ISP's fiber network and the home/SMB LAN. The vulnerability resides in the embedded HTTP administration interface (the BOA-derived web server, indicated by the /boaform/ URI prefix common to many Chinese consumer router firmwares), specifically in the formPPPEdit CGI handler that processes PPPoE connection edits. The root cause is CWE-121 (Stack-based Buffer Overflow): user-controlled input from the 'encodename' POST/GET argument is copied into a fixed-size stack buffer without bounds checking, enabling adjacent stack memory and the saved return address to be overwritten. On MIPS/ARM-based embedded Linux devices like these, such corruption typically leads to control of the program counter and code execution in the context of the web server (often root).
Know when Hg7Hg9 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
Lifecycle Timeline
1DescriptionCVE.org
A vulnerability was found in Tenda HG7HG9 and HG10 300001138_en_xpon. This affects the function formPPPEdit of the file /boaform/formPPPEdit. The manipulation of the argument encodename results in stack-based buffer overflow. The attack can be launched remotely. The exploit has been made public and could be used.
Executive ViewAI
Tenda XPON ONT routers (HG7, HG9, HG10 running firmware 300001138_en_xpon) contain a stack-based buffer overflow vulnerability with publicly available exploit code, creating immediate operational risk to broadband network infrastructure. Without available vendor patches, organizations deploying these devices face prolonged exploitation exposure that requires urgent containment measures. This vulnerability directly threatens confidentiality, integrity, and availability of network services dependent on affected routers.
No vendor-released patch identified at time of analysis. Interim mitigations: enforce network segmentation restricting access to affected routers to dedicated management VLANs only; implement strict firewall policies limiting /boaform/formPPPEdit access to authorized administrative IP ranges; disable unused PPP configuration features at the application level where supported; deploy endpoint detection and response on adjacent network infrastructure; conduct daily log reviews and configuration audits on affected devices for unauthorized changes; establish out-of-band management access to enable rapid response if in-band interfaces are compromised.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than it was allocated to hold.
Stack-based buffer overflow in Tenda HG7HG9 and HG10 routers (firmware 300001138_en_xpon) allows remote attackers to cor
Stack-based buffer overflow in Tenda HG7, HG9, and HG10 ONT/router devices (firmware 300001138_en_xpon) allows authentic
Exploit-DB