CVE-2026-82542
Received Received - Intake

Buffer Overflow in Tenda HG10 Boa Web Server

Publication date: 2026-08-30

Last updated on: 2026-08-30

Assigner: VulDB

Description
A weakness has been identified in Tenda HG10 300001138. Affected by this issue is the function formIPv6Routing of the file /boaform/admin/formIPv6Routing of the component Boa Web Server. This manipulation of the argument destNet causes buffer overflow. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-30
Last Modified
2026-08-30
Generated
2026-08-30
AI Q&A
2026-08-30
EPSS Evaluated
N/A
NVD
CVE-2026-82542
EUVD
EUVD-2026-68200

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
tenda hg10 300001138
tenda boa_web_server *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-120 The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer.
CWE-119 The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a buffer overflow in the Tenda HG10 router's Boa web server. It occurs in the formIPv6Routing function when handling the destNet parameter. The issue arises because the parameter is copied into a fixed-size buffer without proper length checks. A remote attacker can exploit this by sending a specially crafted HTTP request with an overly long destNet value, potentially causing the router to crash or execute arbitrary code.

Detection Guidance

To detect this vulnerability, monitor network traffic for unusual POST requests to the /boaform/admin/formIPv6Routing endpoint. Check for malformed or excessively long destNet parameter values in HTTP requests. Use network scanning tools like nmap to identify vulnerable Tenda HG10 devices on your network.

Impact Analysis

This vulnerability allows remote attackers to cause a denial-of-service condition, making the router unresponsive. In some cases, it may also enable arbitrary code execution, which could lead to full device compromise. Attackers can exploit this without authentication, meaning any exposed router is at risk.

Compliance Impact

This vulnerability could lead to unauthorized access or control of network devices, potentially exposing sensitive data. For GDPR, it may violate data protection requirements if personal data is compromised. For HIPAA, it could risk protected health information if medical devices or networks are affected.

Mitigation Strategies

Immediately disconnect the affected Tenda HG10 device from the internet or untrusted networks. Disable the Boa web server if possible or restrict access to trusted IPs. Apply firmware updates from Tenda if available. Monitor device behavior for signs of compromise.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-82542. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart