CVE-2026-6988

Tenda HG10 Boa Service formRouting formRoute buffer overflow

State: Published
Severity: 8.7 High
Published: Apr 25, 2026
Updated: Apr 27, 2026
Reserved: Apr 24, 2026

Description

A flaw has been found in Tenda HG10 HG7_HG9_HG10re_300001138_en_xpon. This issue affects the function formRoute of the file /boaform/formRouting of the component Boa Service. This manipulation of the argument nextHop causes buffer overflow. It is possible to initiate the attack remotely. The exploit has been published and may be used.

Scores

CVSS	Score	Vector	Source
4.0	8.7 High	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P	VulDB
3.1	8.8 High	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R	VulDB
3.0	8.8 High	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R	VulDB
2.0	9.0 High	AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR	VulDB

Weaknesses

CWE-120 Buffer Overflow
CWE-119 Memory Corruption

Affected Products

Product	Versions
HG10Tenda	HG7_HG9_HG10re_300001138_en_xponAffected

References

VDB-359540 | Tenda HG10 Boa Service formRouting formRoute buffer overflowvdb-entrytechnical-description
VDB-359540 | CTI Indicators (IOB, IOC, IOA)signaturepermissions-required
Submit #796427 | Tenda HG10 HG7_HG9_HG10re_300001138_en_xpon Buffer Overflowthird-party-advisory
https://github.com/xyh4ck/iot_poc/blob/main/Tenda/HG10/01_Buffer_Overflow_nextHop/README.mdexploit
https://www.tenda.com.cn/product

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.