CVE-2026-85109 in HG10
Summary
by MITRE • 09/03/2026
A vulnerability was determined in Tenda HG10 300001138. This issue affects the function formLogin of the file /boaform/formLogin of the component Boa Web Server. Executing a manipulation of the argument Username can lead to buffer overflow. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/03/2026
The Tenda HG10 router, specifically running firmware version 300001138, contains a critical security flaw within its embedded Boa Web Server component. This vulnerability is located in the formLogin function found in the /boaform/formLogin file and represents a classic buffer overflow condition triggered by improper handling of user-supplied input. The core technical issue stems from the application's failure to validate or sanitize the length of the Username argument before copying it into a fixed-size memory buffer. When an attacker provides a username string that exceeds the allocated buffer capacity, the excess data overflows into adjacent memory locations, potentially overwriting critical control structures such as return addresses on the stack. This type of flaw is categorized under CWE-120, which describes Buffer Copy without Checking Size of Input, and often falls under the broader category of CWE-787 if it leads to out-of-bounds write operations that compromise memory integrity.
The operational impact of this vulnerability is severe due to its remote exploitable nature. Because the affected function handles login requests via the web interface, an unauthenticated attacker can launch a denial-of-service attack or achieve arbitrary code execution with the privileges of the web server process by sending specially crafted HTTP POST requests containing oversized username fields. The fact that the exploit has been publicly disclosed significantly elevates the risk profile for this device class. Publicly available exploits lower the barrier to entry for malicious actors, allowing individuals without advanced reverse engineering skills to compromise vulnerable systems. This aligns with MITRE ATT&CK technique T1190, Exploit Public-Facing Application, where adversaries leverage known vulnerabilities in internet-accessible services to gain initial access or escalate privileges within a network environment.
The presence of this vulnerability highlights the persistent challenges associated with embedded IoT devices and their reliance on legacy web server implementations like Boa. These systems often prioritize functionality over security hardening, resulting in insufficient input validation mechanisms that are easily bypassed by automated scanning tools or manual exploitation attempts. The buffer overflow condition not only risks crashing the service but also provides a pathway for attackers to inject shellcode, leading to full system compromise. This can result in the device being recruited into botnets, used as pivot points for lateral movement within internal networks, or leveraged to intercept sensitive data transmitted through the router's interface.
Mitigation strategies must focus on immediate remediation and defensive hardening since patch availability may be limited for older firmware versions like 300001138. The primary recommendation is to update the device firmware to a version where this buffer overflow has been patched by implementing proper bounds checking in the formLogin function. If an official patch is unavailable, administrators should consider disabling remote management features entirely and restricting access to the web interface to trusted local networks only. Additionally, deploying network-level intrusion detection systems can help identify attempts to exploit this vulnerability by monitoring for anomalous HTTP POST requests with unusually large payload sizes directed at the router's administrative ports. Long-term mitigation involves replacing legacy hardware that no longer receives security updates with modern devices that adhere to current secure development lifecycle standards and incorporate robust input validation mechanisms consistent with CWE-20, Improper Input Validation.