Monitor vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-82542: Tenda HG10 router can be crashed by remote traffic

CVE-2026-82542 · published 4 days ago

Summary

The Tenda HG10 router’s web administration page has a coding mistake that lets an attacker send specially crafted data and overflow a memory area. This can be done from outside the network and may cause the router to stop working or be taken over. Update the router firmware to the latest version or disable remote web management until a fix is applied.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
tenda	hg10	300001138

Original advisory text

A weakness has been identified in Tenda HG10 300001138. Affected by this issue is the function formIPv6Routing of the file /boaform/admin/formIPv6Routing of the component Boa Web Server. This manipulation of the argument destNet causes buffer overflow. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks.

References

https://vuldb.com/vuln/397058 vdb-entry technical-description
https://vuldb.com/vuln/397058/cti signature permissions-required
https://vuldb.com/cve/CVE-2026-82542 third-party-advisory
https://vuldb.com/submit/888876 third-party-advisory
https://github.com/SunnyYANGyaya/cuicuishark-sheep-fishIOT/blob/main/Tenda/HG10/... exploit
https://www.tenda.com.cn/ product

Severity

9.3 Critical

CVSS 3.1: 10.0 (MITRE)

Exploitation

EPSS <1%

Type

CWE-120Classic Buffer Overflow

CWE-119Buffer Overflow

Timeline

Published30 Aug 2026

Updated2 Sep 2026

First seen30 Aug 2026

Sources

CVE-2026-82542 · NVD

CVE-2026-82542 · MITRE

Monitor software like this

Free during beta