CVE-2026-86167 in HG10
Summary
by MITRE • 09/06/2026
A vulnerability was identified in Tenda HG10 300001138. Impacted is the function formgponConf of the file /boaform/admin/formgponConf of the component Boa. The manipulation of the argument fmgpon_loid leads to os command injection. Remote exploitation of the attack is possible. The exploit is publicly available and might be used.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/08/2026
The Tenda HG10 router, specifically firmware version 300001138, contains a critical security flaw within its embedded web server component known as Boa. This vulnerability resides in the formgponConf function located in the /boaform/admin/formgponConf file. The core issue stems from improper input validation and sanitization of user-supplied data passed via the fmgpon_loid argument. When this parameter is processed by the backend script, it is directly concatenated into system commands without adequate filtering or escaping mechanisms. This architectural weakness allows an attacker to inject arbitrary operating system commands that are executed with the privileges of the web server process, which typically runs as root on embedded devices like routers.
This specific flaw represents a classic instance of OS Command Injection, categorized under CWE-78 in the Common Weakness Enumeration standard. The vulnerability is particularly severe because it enables remote code execution without requiring authentication if the affected endpoint is accessible over the network or through certain unauthenticated administrative interfaces often found on consumer-grade networking equipment. An attacker can leverage this weakness to execute arbitrary commands on the underlying Linux operating system hosting the router firmware. This capability fundamentally breaks the isolation between the web interface and the host system, allowing for complete compromise of the device's integrity and confidentiality.
The operational impact of exploiting this vulnerability is extensive and potentially catastrophic for network security. Once an attacker gains command execution capabilities, they can install persistent backdoors, exfiltrate sensitive data such as Wi-Fi credentials or ISP configuration details, pivot into internal networks connected to the router, or use the device as part of a botnet for distributed denial-of-service attacks. The fact that public exploits are available significantly lowers the barrier to entry for malicious actors, increasing the likelihood of automated scanning and exploitation campaigns targeting vulnerable devices across the internet. This situation aligns with MITRE ATT&CK techniques related to Command and Scripting Interpreter abuse, specifically lateral movement or persistence mechanisms enabled by remote code execution.
Mitigation strategies must address both immediate remediation and long-term security hygiene. The primary solution is for users to update their Tenda HG10 firmware to the latest version provided by the manufacturer, which should include patches that properly sanitize input parameters like fmgpon_loid before they are passed to system commands. If an official patch is unavailable or delayed, network administrators can implement temporary compensating controls such as restricting access to the administrative interface via firewall rules, disabling remote management features entirely, and changing default credentials if applicable. Additionally, monitoring network traffic for unusual outbound connections from router IP addresses can help detect potential compromise early. Organizations should also consider segmenting IoT devices on separate VLANs to limit the blast radius of any successful exploitation attempt.