CVE-2026-86166 in HG10
Summary
by MITRE • 09/06/2026
A vulnerability was determined in Tenda HG10 300001138. This issue affects the function formWanRedirect of the file /boaform/formWanRedirect of the component Boa Web Server. Executing a manipulation of the argument if can lead to buffer overflow. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/06/2026
The Tenda HG10 router, specifically running firmware version 300001138, contains a critical security flaw within its embedded Boa Web Server implementation. This vulnerability resides in the formWanRedirect function located in the /boaform/formWanRedirect file, which is responsible for handling network address translation and port forwarding configurations via the device's web interface. The core technical issue stems from improper bounds checking when processing user-supplied input passed through the if argument during WAN redirect rule creation or modification operations. When an attacker provides a specially crafted string that exceeds the expected buffer size without adequate validation, it triggers a classic stack-based buffer overflow condition within the C code executing this function.
This memory corruption vulnerability allows for arbitrary code execution with the privileges of the web server process, which typically runs as root on embedded Linux devices to facilitate hardware configuration changes. Because the Boa Web Server is accessible over the network interface, an unauthenticated attacker can launch a remote exploit against the target device without requiring prior authentication credentials. The ability to execute arbitrary commands remotely transforms this from a simple denial-of-service risk into a severe compromise of system integrity and confidentiality. Attackers can leverage this flaw to install persistent backdoors, pivot into internal networks, or exfiltrate sensitive data stored on the router such as Wi-Fi passwords and connected device information.
The operational impact is significant given that routers often serve as the primary gateway for home and small business networks. Compromise of the Tenda HG10 allows an adversary to intercept traffic, perform man-in-the-middle attacks, or use the compromised device as part of a botnet infrastructure like Mirai variants which target IoT devices with weak security postures. The fact that this exploit has been publicly disclosed means that automated scanning tools and malicious actors can readily identify vulnerable instances on the internet, increasing the likelihood of widespread exploitation in unpatched environments. This aligns with Common Weakness Enumeration CWE-120 regarding buffer copy without checking size limits and is often associated with ATT&CK technique T1190 Exploit Public-Facing Application where adversaries leverage known vulnerabilities to gain initial access.
Mitigation strategies must prioritize immediate patching if a firmware update addressing this specific flaw in the formWanRedirect function has been released by Tenda for version 300001138 or later. In cases where updates are unavailable, network segmentation is critical; administrators should restrict management interface access to trusted IP addresses only and disable remote administration features entirely if not required. Additionally, implementing strict input validation at the application layer through custom firmware modifications can prevent buffer overflow conditions by ensuring all arguments passed to C functions like formWanRedirect are sanitized for length before processing. Security monitoring tools that detect anomalous HTTP requests targeting web server endpoints with unusually long parameters should also be deployed to identify potential exploitation attempts in real-time.