CVE-2026-104610 in HG7
Summary
by MITRE • 10/02/2026
A security vulnerability has been detected in Tenda HG7, HG9 and HG10 300001138_en_xpon. This impacts the function boaGetVar of the file /boaform/formLoopBack of the component Boa Web Server. Such manipulation of the argument Ethtype leads to stack-based buffer overflow. The attack can be executed remotely. The exploit has been disclosed publicly and may be used.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/02/2026
The Tenda HG7, HG9, and HG10 routers running firmware version 300001138_en_xpon contain a critical security flaw within their embedded Boa Web Server implementation. This vulnerability specifically affects the boaGetVar function located in the /boaform/formLoopBack file. The core technical issue is a stack-based buffer overflow triggered by improper handling of input data, particularly when manipulating the Ethtype argument. In C programming languages commonly used for embedded systems, functions like boaGetVar often copy user-supplied strings into fixed-size buffers on the call stack without adequate bounds checking. When an attacker provides an Ethtype value that exceeds the allocated memory space, it overwrites adjacent memory locations on the stack. This corruption can overwrite critical data such as return addresses, function pointers, or other control flow variables, allowing for arbitrary code execution with the privileges of the web server process, which typically runs with high-level system access in router environments.
From an operational perspective, this vulnerability is particularly severe because it allows remote exploitation without requiring authentication. Attackers can send specially crafted HTTP requests to the device's management interface over a network connection, triggering the buffer overflow and potentially gaining full control of the router. This level of compromise enables adversaries to intercept traffic, redirect users to malicious sites, install persistent backdoors, or use the compromised device as part of a larger botnet for distributed denial-of-service attacks. The fact that an exploit has been publicly disclosed significantly increases the risk landscape, as automated scanning tools and less sophisticated attackers can now leverage this known weakness against vulnerable devices in real-time. This aligns with Common Weakness Enumeration (CWE) category CWE-120, which describes buffer copies without checking size limits, a classic precursor to remote code execution vulnerabilities in network-facing services.
The attack vector falls under the MITRE ATT&CK framework's Initial Access and Execution techniques, specifically leveraging web application attacks to gain foothold on internal networks. Once inside, attackers may proceed with lateral movement or privilege escalation depending on the router's architecture and subsequent configuration weaknesses. Mitigation strategies must prioritize immediate patching if a vendor-provided firmware update is available that addresses the input validation in the boaGetVar function. In cases where updates are not immediately accessible, network-level controls such as firewall rules restricting access to the web management interface from untrusted networks can provide temporary relief. Additionally, disabling remote administration features and ensuring that only trusted IP ranges can reach the device's HTTP ports reduces the attack surface significantly. Long-term remediation involves replacing outdated firmware with secure versions or upgrading hardware to models that receive regular security updates and adhere to modern embedded development practices including stack protection mechanisms like ASLR and DEP/NX bits where supported by the processor architecture.