PT-2026-90995

A vulnerability was detected in Totolink A3002MU Hh-B20211125.1046. Impacted is the function formNewSchedule of the file /boafrm/formNewSchedule of the component boa. The manipulation of the argument submit-url results in buffer overflow. The attack may be performed from remote. The exploit is no...

CVE-2026-90606 Totolink A3002MU boa formIpv6Setup buffer overflow

A security vulnerability has been detected in Totolink A3002MU Hh-B20211125.1046. This issue affects the function formIpv6Setup of the file /boafrm/formIpv6Setup of the component boa. The manipulation of the argument staticipv6 leads to buffer overflow. The attack is possible to be carried out...

CVE-2026-90605

CVE-2026-90605 affects the Totolink A3002MU router (firmware Hh-B20211125.1046 ). The vulnerability resides in the boa web server component, specifically in the formFilter function of the file /boafrm/formFilter . Manipulating the ip6addr argument triggers a buffer overflow , allowing a remote at...

PT-2026-90991

A security vulnerability has been detected in Totolink A3002MU Hh-B20211125.1046. This issue affects the function formIpv6Setup of the file /boafrm/formIpv6Setup of the component boa. The manipulation of the argument static ipv6 leads to buffer overflow. The attack is possible to be carried out...

PT-2026-90990

A weakness has been identified in Totolink A3002MU Hh-B20211125.1046. This vulnerability affects the function formFilter of the file /boafrm/formFilter of the component boa. Executing a manipulation of the argument ip6addr can lead to buffer overflow. The attack can be executed remotely. The...

boa-cve-2009-4496-analysis

CVE-2009-4496 — Defensive Vulnerability Analysis Overview This repository documents a defensive analysis of CVE-2009-4496 , a historical vulnerability associated with the Boa web server. The objective of this project is to examine the vulnerability from a defensive security perspective through:...

CVE-2026-36957

CVE-2026-36957：Boa Web 服务器因 HTTP 洪泛攻击导致拒绝服务 CVE ID： CVE-2026-36957 日期： 2026-04-29 发现者： Kirubel Solomne 厂商： 深圳市迪比特网络设备有限公司 产品： Dbit 路由器 固件版本： V1.0.0 CWE： CWE-400 - 未受控的资源消耗 描述 Dbit 路由器固件 V1.0.0 存在通过 Boa Web 服务器 URI 处理器导致的拒绝服务漏洞。攻击者向不存在的 URI 发送大量 HTTP GET...

CVE-2026-36958

CVE-2026-36958：通过并发 HTTP 请求导致的拒绝服务 CVE ID： CVE-2026-36958 日期： 2026-04-29 发现者： Kirubel Solomne 厂商： U-SPEED 产品： U-SPEED 路由器 固件版本： V1.0.0 CWE： CWE-400 - 未受控制的资源消耗 描述 U-SPEED 路由器固件 V1.0.0 存在拒绝服务漏洞。攻击者通过向 Web 管理界面发送大量并发 HTTP 请求到随机或不存在的端点，可耗尽嵌入式 Boa HTTP 服务器中的系统资源。这会导致路由器 Web 界面无响应，可能需要手动重启才能恢复正常运行。 CV...

CVE-2026-86167

A vulnerability was identified in Tenda HG10 300001138. Impacted is the function formgponConf of the file /boaform/admin/formgponConf of the component Boa. The manipulation of the argument fmgponloid leads to os command injection. Remote exploitation of the attack is possible. The exploit is...

CVE-2026-86167 Tenda HG10 Boa formgponConf os command injection

A vulnerability was identified in Tenda HG10 300001138. Impacted is the function formgponConf of the file /boaform/admin/formgponConf of the component Boa. The manipulation of the argument fmgponloid leads to os command injection. Remote exploitation of the attack is possible. The exploit is...

CVE-2026-86167

Tenda HG10 (firmware 300001138) is affected by an OS command injection vulnerability in the Boa component. The vulnerable function formgponConf , located at /boaform/admin/formgponConf, allows an attacker to manipulate the fmgpon_loid argument to inject and execute arbitrary OS commands. The vuln...

EUVD-2026-72055

A vulnerability was identified in Tenda HG10 300001138. Impacted is the function formgponConf of the file /boaform/admin/formgponConf of the component Boa. The manipulation of the argument fmgponloid leads to os command injection. Remote exploitation of the attack is possible. The exploit is...

CVE-2026-86166

A vulnerability was determined in Tenda HG10 300001138. This issue affects the function formWanRedirect of the file /boaform/formWanRedirect of the component Boa Web Server. Executing a manipulation of the argument if can lead to buffer overflow. The attack may be launched remotely. The exploit h...

CVE-2026-86166 Tenda HG10 Boa Web Server formWanRedirect buffer overflow

A vulnerability was determined in Tenda HG10 300001138. This issue affects the function formWanRedirect of the file /boaform/formWanRedirect of the component Boa Web Server. Executing a manipulation of the argument if can lead to buffer overflow. The attack may be launched remotely. The exploit h...

CVE-2026-86166

Tenda HG10 (firmware 300001138 ) is affected by a buffer overflow in the Boa Web Server component, specifically in the formWanRedirect() function of the /boaform/formWanRedirect endpoint. A remote, low-privilege attacker can trigger the vulnerability by manipulating the if argument, leading to hi...

EUVD-2026-72050

A vulnerability was determined in Tenda HG10 300001138. This issue affects the function formWanRedirect of the file /boaform/formWanRedirect of the component Boa Web Server. Executing a manipulation of the argument if can lead to buffer overflow. The attack may be launched remotely. The exploit h...

PT-2026-86478

A vulnerability was identified in Tenda HG10 300001138. Impacted is the function formgponConf of the file /boaform/admin/formgponConf of the component Boa. The manipulation of the argument fmgpon loid leads to os command injection. Remote exploitation of the attack is possible. The exploit is...

CVE-2026-85110

A vulnerability was identified in Tenda HG10 300001138. Impacted is the function formWlanSetup of the file /boaform/formWlanSetup of the component Boa Web Server. The manipulation of the argument ssid leads to buffer overflow. Remote exploitation of the attack is possible. The exploit is publicly...

CVE-2026-85109

A vulnerability was determined in Tenda HG10 300001138. This issue affects the function formLogin of the file /boaform/formLogin of the component Boa Web Server. Executing a manipulation of the argument Username can lead to buffer overflow. The attack may be launched remotely. The exploit has bee...

EUVD-2026-70471

A vulnerability was identified in Tenda HG10 300001138. Impacted is the function formWlanSetup of the file /boaform/formWlanSetup of the component Boa Web Server. The manipulation of the argument ssid leads to buffer overflow. Remote exploitation of the attack is possible. The exploit is publicly...