tenda-hg10-rce

CVE-2026-1689 Resumen Existe una vulnerabilidad de inyección de comandos en el router Tenda HG10. Se produce en el endpoint formLogin debido al manejo inadecuado del parámetro Host. No se verifican credenciales de autenticación, ya que esto se ejecuta antes de la comprobación. La entrada del...

CVE-2026-86167

A vulnerability was identified in Tenda HG10 300001138. Impacted is the function formgponConf of the file /boaform/admin/formgponConf of the component Boa. The manipulation of the argument fmgponloid leads to os command injection. Remote exploitation of the attack is possible. The exploit is...

CVE-2026-86167 Tenda HG10 Boa formgponConf os command injection

A vulnerability was identified in Tenda HG10 300001138. Impacted is the function formgponConf of the file /boaform/admin/formgponConf of the component Boa. The manipulation of the argument fmgponloid leads to os command injection. Remote exploitation of the attack is possible. The exploit is...

CVE-2026-86167

Tenda HG10 (firmware 300001138) is affected by an OS command injection vulnerability in the Boa component. The vulnerable function formgponConf , located at /boaform/admin/formgponConf, allows an attacker to manipulate the fmgpon_loid argument to inject and execute arbitrary OS commands. The vuln...

EUVD-2026-72055

A vulnerability was identified in Tenda HG10 300001138. Impacted is the function formgponConf of the file /boaform/admin/formgponConf of the component Boa. The manipulation of the argument fmgponloid leads to os command injection. Remote exploitation of the attack is possible. The exploit is...

CVE-2026-86166

A vulnerability was determined in Tenda HG10 300001138. This issue affects the function formWanRedirect of the file /boaform/formWanRedirect of the component Boa Web Server. Executing a manipulation of the argument if can lead to buffer overflow. The attack may be launched remotely. The exploit h...

CVE-2026-86165

A vulnerability was found in Tenda HG10 300001138. This vulnerability affects the function formURL of the file /boaform/admin/formURL. Performing a manipulation of the argument Keywd/urlFQDN results in buffer overflow. The attack may be initiated remotely. The exploit has been made public and cou...

CVE-2026-86166 Tenda HG10 Boa Web Server formWanRedirect buffer overflow

A vulnerability was determined in Tenda HG10 300001138. This issue affects the function formWanRedirect of the file /boaform/formWanRedirect of the component Boa Web Server. Executing a manipulation of the argument if can lead to buffer overflow. The attack may be launched remotely. The exploit h...

CVE-2026-86166

Tenda HG10 (firmware 300001138 ) is affected by a buffer overflow in the Boa Web Server component, specifically in the formWanRedirect() function of the /boaform/formWanRedirect endpoint. A remote, low-privilege attacker can trigger the vulnerability by manipulating the if argument, leading to hi...

EUVD-2026-72050

A vulnerability was determined in Tenda HG10 300001138. This issue affects the function formWanRedirect of the file /boaform/formWanRedirect of the component Boa Web Server. Executing a manipulation of the argument if can lead to buffer overflow. The attack may be launched remotely. The exploit h...

CVE-2026-86165 Tenda HG10 formURL buffer overflow

A vulnerability was found in Tenda HG10 300001138. This vulnerability affects the function formURL of the file /boaform/admin/formURL. Performing a manipulation of the argument Keywd/urlFQDN results in buffer overflow. The attack may be initiated remotely. The exploit has been made public and cou...

EUVD-2026-72049

A vulnerability was found in Tenda HG10 300001138. This vulnerability affects the function formURL of the file /boaform/admin/formURL. Performing a manipulation of the argument Keywd/urlFQDN results in buffer overflow. The attack may be initiated remotely. The exploit has been made public and cou...

CVE-2026-86165

CVE-2026-86165 is a buffer overflow in the formURL function of /boaform/admin/formURL on the Tenda HG10 router (firmware 300001138 ). Manipulating the Keywd/urlFQDN argument triggers the overflow, exploitable remotely without authentication . The base CVSS 3.1 score is 9.8 (CRITICAL) . A proof-of...

PT-2026-86478

A vulnerability was identified in Tenda HG10 300001138. Impacted is the function formgponConf of the file /boaform/admin/formgponConf of the component Boa. The manipulation of the argument fmgpon loid leads to os command injection. Remote exploitation of the attack is possible. The exploit is...

PT-2026-86469

Name of the Vulnerable Software and Affected Versions Tenda HG10 affected versions not specified Description A buffer overflow exists in the Boa Web Server component within the formWanRedirect function of the /boaform/formWanRedirect endpoint. A remote attacker can trigger this issue by...

PT-2026-86468

Name of the Vulnerable Software and Affected Versions Tenda HG10 affected versions not specified Description A remote buffer overflow exists in the formURL function within the /boaform/admin/formURL endpoint. This issue occurs when the Keywd/urlFQDN argument is manipulated, potentially allowing a...

CVE-2026-85110

A vulnerability was identified in Tenda HG10 300001138. Impacted is the function formWlanSetup of the file /boaform/formWlanSetup of the component Boa Web Server. The manipulation of the argument ssid leads to buffer overflow. Remote exploitation of the attack is possible. The exploit is publicly...

CVE-2026-85109

A vulnerability was determined in Tenda HG10 300001138. This issue affects the function formLogin of the file /boaform/formLogin of the component Boa Web Server. Executing a manipulation of the argument Username can lead to buffer overflow. The attack may be launched remotely. The exploit has bee...

EUVD-2026-70471

A vulnerability was identified in Tenda HG10 300001138. Impacted is the function formWlanSetup of the file /boaform/formWlanSetup of the component Boa Web Server. The manipulation of the argument ssid leads to buffer overflow. Remote exploitation of the attack is possible. The exploit is publicly...

CVE-2026-85110

Tenda HG10 (version 300001138) is affected by a buffer overflow in the Boa Web Server component, specifically in the formWlanSetup function at /boaform/formWlanSetup, triggered by manipulating the ssid argument. The vulnerability allows remote exploitation with low privileges and no user interact...