Hg10
Monthly
Stack-based buffer overflow in the Boa Web Server component of Tenda HG7, HG9 and HG10 XPON gateways running firmware 300001138_en_xpon allows remote, unauthenticated attackers to corrupt memory by sending a crafted request to the /boaform/formLoopBack endpoint with an oversized Ethtype argument. The assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8) confirms no authentication or user interaction is required, and publicly available exploit code exists, so the practical risk hinges on whether the device's management web interface is reachable from the WAN or another untrusted network. Impact is bounded to these specific XPON gateway firmware builds.
OS command injection in Tenda HG10 GPON router firmware 300001138 allows authenticated network attackers to execute arbitrary shell commands on the device by manipulating the `fmgpon_loid` parameter in the `/boaform/admin/formgponConf` endpoint served by the Boa embedded web server. The `fmgpon_loid` argument (GPON Line OID) is passed unsanitized to a system call (CWE-78), giving an attacker full control over the underlying Linux OS. A public proof-of-concept exploit exists on GitHub, and the CVSS 4.0 E:P supplemental metric confirms exploit code is available.
Buffer overflow in the Tenda HG10 router (firmware version 300001138) via the `formWanRedirect` function allows a network-authenticated attacker to overwrite control-flow data in the Boa embedded web server process, enabling remote code execution or device crash. The vulnerable endpoint `/boaform/formWanRedirect` fails to validate the length of the `if` argument before copying it into a fixed-size buffer (CWE-120). A public proof-of-concept exploit is available on GitHub, and no vendor-released patch has been identified at time of analysis.
Remote unauthenticated buffer overflow in Tenda HG10 firmware 300001138 allows network attackers to corrupt memory and likely achieve code execution via the formURL function at /boaform/admin/formURL. Oversized values in the Keywd or urlFQDN parameters are copied into a fixed-size buffer without length validation (CWE-120), with full confidentiality, integrity, and availability impact per the CVSS 4.0 vector. A public proof-of-concept exploit is available on GitHub, raising near-term exploitation risk despite the absence of a CISA KEV listing.
Buffer overflow in Tenda HG10 router firmware version 300001138 enables network-accessible authenticated attackers to overflow memory in the Boa embedded web server's WLAN configuration handler, potentially achieving arbitrary code execution. The vulnerable parameter is `ssid` within the `/boaform/formWlanSetup` endpoint, which lacks input length validation per CWE-120. A public proof-of-concept is hosted on GitHub, concretely lowering the exploitation bar; no vendor patch has been identified at time of analysis.
Pre-authentication remote buffer overflow in Tenda HG10 router firmware version 300001138 allows unauthenticated network attackers to execute arbitrary code by sending an oversized Username value to the Boa Web Server's /boaform/formLogin endpoint. The formLogin function performs no bounds checking on the supplied credential field, enabling stack or heap corruption reachable directly from the WAN or LAN interface without any prior authentication. A public proof-of-concept exploit has been disclosed on GitHub, materially lowering the bar for exploitation. No public exploit identified at time of analysis is overridden here: publicly available exploit code exists.
Remote code execution and device takeover in the Tenda HG10 (firmware build 300001138) is possible through a stack buffer overflow in the Boa web server's formIPv6Routing handler, reachable at /boaform/admin/formIPv6Routing. An oversized destNet parameter overflows a fixed-size buffer (CWE-120), letting a remote attacker crash the device or execute arbitrary code with the web server's privileges. Publicly available exploit code exists (VulDB), though the issue is not listed in CISA KEV and no active exploitation is confirmed; EPSS is not provided.
Stack-based buffer overflow in Tenda HG7, HG9, and HG10 XPON ONT routers (firmware 300001138_en_xpon) allows authenticated remote attackers to corrupt memory via the encodename parameter of the formPPPEdit handler at /boaform/formPPPEdit. Publicly available exploit code exists (hosted on GitHub by researcher xiezhihua-1127), elevating practical risk despite no confirmed active exploitation in CISA KEV. Successful exploitation yields high impact to confidentiality, integrity, and availability on the affected device.
Stack-based buffer overflow in Tenda HG7HG9 and HG10 routers (firmware 300001138_en_xpon) allows remote attackers to corrupt memory via the blkDomain parameter in the formDOMAINBLK handler at /boaform/formDOMAINBLK. The CVSS 4.0 score of 9.3 reflects network-reachable, unauthenticated exploitation with high impact to confidentiality, integrity, and availability, and a public proof-of-concept repository has been published on GitHub by researcher ssaaaa1234, though no public exploit has been confirmed as active exploitation.
Stack-based buffer overflow in Tenda HG7, HG9, and HG10 ONT/router devices (firmware 300001138_en_xpon) allows authenticated remote attackers to corrupt memory by manipulating the funckey_transfer parameter sent to the /boaform/voip_other_set endpoint handled by the asp_voip_OtherSet function. Publicly available exploit code exists via a dedicated GitHub proof-of-concept repository, and the flaw scores CVSS 4.0 8.7 with full confidentiality, integrity, and availability impact. No public exploit identified in CISA KEV at time of analysis, but exposure of the Web Management Interface to untrusted networks materially raises real-world risk.
Stack-based buffer overflow in the Boa Web Server component of Tenda HG7, HG9 and HG10 XPON gateways running firmware 300001138_en_xpon allows remote, unauthenticated attackers to corrupt memory by sending a crafted request to the /boaform/formLoopBack endpoint with an oversized Ethtype argument. The assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8) confirms no authentication or user interaction is required, and publicly available exploit code exists, so the practical risk hinges on whether the device's management web interface is reachable from the WAN or another untrusted network. Impact is bounded to these specific XPON gateway firmware builds.
OS command injection in Tenda HG10 GPON router firmware 300001138 allows authenticated network attackers to execute arbitrary shell commands on the device by manipulating the `fmgpon_loid` parameter in the `/boaform/admin/formgponConf` endpoint served by the Boa embedded web server. The `fmgpon_loid` argument (GPON Line OID) is passed unsanitized to a system call (CWE-78), giving an attacker full control over the underlying Linux OS. A public proof-of-concept exploit exists on GitHub, and the CVSS 4.0 E:P supplemental metric confirms exploit code is available.
Buffer overflow in the Tenda HG10 router (firmware version 300001138) via the `formWanRedirect` function allows a network-authenticated attacker to overwrite control-flow data in the Boa embedded web server process, enabling remote code execution or device crash. The vulnerable endpoint `/boaform/formWanRedirect` fails to validate the length of the `if` argument before copying it into a fixed-size buffer (CWE-120). A public proof-of-concept exploit is available on GitHub, and no vendor-released patch has been identified at time of analysis.
Remote unauthenticated buffer overflow in Tenda HG10 firmware 300001138 allows network attackers to corrupt memory and likely achieve code execution via the formURL function at /boaform/admin/formURL. Oversized values in the Keywd or urlFQDN parameters are copied into a fixed-size buffer without length validation (CWE-120), with full confidentiality, integrity, and availability impact per the CVSS 4.0 vector. A public proof-of-concept exploit is available on GitHub, raising near-term exploitation risk despite the absence of a CISA KEV listing.
Buffer overflow in Tenda HG10 router firmware version 300001138 enables network-accessible authenticated attackers to overflow memory in the Boa embedded web server's WLAN configuration handler, potentially achieving arbitrary code execution. The vulnerable parameter is `ssid` within the `/boaform/formWlanSetup` endpoint, which lacks input length validation per CWE-120. A public proof-of-concept is hosted on GitHub, concretely lowering the exploitation bar; no vendor patch has been identified at time of analysis.
Pre-authentication remote buffer overflow in Tenda HG10 router firmware version 300001138 allows unauthenticated network attackers to execute arbitrary code by sending an oversized Username value to the Boa Web Server's /boaform/formLogin endpoint. The formLogin function performs no bounds checking on the supplied credential field, enabling stack or heap corruption reachable directly from the WAN or LAN interface without any prior authentication. A public proof-of-concept exploit has been disclosed on GitHub, materially lowering the bar for exploitation. No public exploit identified at time of analysis is overridden here: publicly available exploit code exists.
Remote code execution and device takeover in the Tenda HG10 (firmware build 300001138) is possible through a stack buffer overflow in the Boa web server's formIPv6Routing handler, reachable at /boaform/admin/formIPv6Routing. An oversized destNet parameter overflows a fixed-size buffer (CWE-120), letting a remote attacker crash the device or execute arbitrary code with the web server's privileges. Publicly available exploit code exists (VulDB), though the issue is not listed in CISA KEV and no active exploitation is confirmed; EPSS is not provided.
Stack-based buffer overflow in Tenda HG7, HG9, and HG10 XPON ONT routers (firmware 300001138_en_xpon) allows authenticated remote attackers to corrupt memory via the encodename parameter of the formPPPEdit handler at /boaform/formPPPEdit. Publicly available exploit code exists (hosted on GitHub by researcher xiezhihua-1127), elevating practical risk despite no confirmed active exploitation in CISA KEV. Successful exploitation yields high impact to confidentiality, integrity, and availability on the affected device.
Stack-based buffer overflow in Tenda HG7HG9 and HG10 routers (firmware 300001138_en_xpon) allows remote attackers to corrupt memory via the blkDomain parameter in the formDOMAINBLK handler at /boaform/formDOMAINBLK. The CVSS 4.0 score of 9.3 reflects network-reachable, unauthenticated exploitation with high impact to confidentiality, integrity, and availability, and a public proof-of-concept repository has been published on GitHub by researcher ssaaaa1234, though no public exploit has been confirmed as active exploitation.
Stack-based buffer overflow in Tenda HG7, HG9, and HG10 ONT/router devices (firmware 300001138_en_xpon) allows authenticated remote attackers to corrupt memory by manipulating the funckey_transfer parameter sent to the /boaform/voip_other_set endpoint handled by the asp_voip_OtherSet function. Publicly available exploit code exists via a dedicated GitHub proof-of-concept repository, and the flaw scores CVSS 4.0 8.7 with full confidentiality, integrity, and availability impact. No public exploit identified in CISA KEV at time of analysis, but exposure of the Web Management Interface to untrusted networks materially raises real-world risk.