CVE-2026-86166

Deferred Deferred - Pending Action

Buffer Overflow in Tenda HG10 Router Firmware

Publication date: 2026-09-06

Last updated on: 2026-09-11

Assigner: VulDB

Description

A vulnerability was determined in Tenda HG10 300001138. This issue affects the function formWanRedirect of the file /boaform/formWanRedirect of the component Boa Web Server. Executing a manipulation of the argument if can lead to buffer overflow. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-06

Last Modified

2026-09-11

Generated

2026-09-26

AI Q&A

2026-09-06

EPSS Evaluated

2026-09-25

NVD

CVE-2026-86166

EUVD

EUVD-2026-72050

Affected Vendors & Products

Vendor	Product	Version / Range
tenda	hg10	From 300001138 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-119	The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
CWE-120	The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer.

Attack-Flow Graph

Executive Summary

CVE-2026-86166 is a buffer overflow vulnerability in the Tenda HG10 AC1200 Dualband Wi-Fi xPON ONT router. It exists in the Boa web server's formWanRedirect interface due to insufficient length validation of the 'if' parameter. A remote attacker can exploit this by sending a crafted HTTP POST request with an overly long 'if' parameter to the /boaform/formWanRedirect endpoint, causing memory corruption and potential denial of service.

Detection Guidance

To detect this vulnerability, check if your Tenda HG10 router is running firmware version HG7_HG9_HG10re_300001138. You can verify this by accessing the router's admin panel or using network scanning tools to identify the device and its firmware version.

Impact Analysis

This vulnerability allows remote attackers to crash the router by sending a specially crafted request, making it unresponsive. This could disrupt internet connectivity and network services for users relying on the affected Tenda HG10 device. The attack does not require authentication and can be executed from anywhere on the network.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by enabling unauthorized remote access to the router's web interface. A buffer overflow exploit may allow attackers to gain control over the device, leading to unauthorized data access or manipulation. This could violate data protection requirements under GDPR (e.g., unauthorized access to personal data) and HIPAA (e.g., unauthorized access to protected health information).

Mitigation Strategies

Immediately update the router's firmware to the latest version provided by Tenda. If no update is available, consider isolating the device from the internet or disabling the Boa web server interface to prevent remote exploitation.

Hi! I’m here to help you understand CVE-2026-86166. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70