Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.3
CVE-2026-104610: Tenda HG7/HG9/HG10 remote code execution via web form
CVE-2026-104610 · published 17 days ago
Summary
The web interface on Tenda HG7, HG9 and HG10 devices can be tricked into running malicious code when a specially crafted request is sent. This could allow an attacker on the network to take control of the router. Apply the latest firmware update from Tenda as soon as possible to fix the issue.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| tenda | hg7 | 300001138_en_xpon |
| tenda | hg9 | 300001138_en_xpon |
| tenda | hg10 | 300001138_en_xpon |
Original advisory text
Tenda HG7/HG9/HG10 Boa Web Server formLoopBack boaGetVar stack-based overflow
A security vulnerability has been detected in Tenda HG7, HG9 and HG10 300001138_en_xpon. This impacts the function boaGetVar of the file /boaform/formLoopBack of the component Boa Web Server. Such manipulation of the argument Ethtype leads to stack-based buffer overflow. The attack can be executed remotely. The exploit has been disclosed publicly and may be used.
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker full control
Type
CWE-119Buffer Overflow
CWE-121Stack-based Buffer Overflow
Timeline
Published2 Oct 2026
Updated15 Oct 2026
First seen2 Oct 2026
Track software like this
Free during beta