CVE-2026-86167
Received Received - Intake

Command Injection in Tenda HG10 Router

Publication date: 2026-09-06

Last updated on: 2026-09-06

Assigner: VulDB

Description
A vulnerability was identified in Tenda HG10 300001138. Impacted is the function formgponConf of the file /boaform/admin/formgponConf of the component Boa. The manipulation of the argument fmgpon_loid leads to os command injection. Remote exploitation of the attack is possible. The exploit is publicly available and might be used.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-06
Last Modified
2026-09-06
Generated
2026-09-06
AI Q&A
2026-09-06
EPSS Evaluated
N/A
NVD
CVE-2026-86167
EUVD
EUVD-2026-72055

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
tenda hg10 300001138
boa boa *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-77 The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
CWE-78 The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-86167 is a command injection vulnerability in the Tenda HG10 router's Boa web server. It affects the formgponConf interface where the fmgpon_loid parameter is improperly validated. Attackers can send a crafted POST request to /boaform/admin/formgponConf to inject and execute arbitrary system commands on the device.

Detection Guidance

To detect this vulnerability, scan for devices running the vulnerable Tenda HG10 firmware version HG7_HG9_HG10re_300001138. Check for open ports 80 or 443 and send a POST request to /boaform/admin/formgponConf with a test payload in the fmgpon_loid parameter. If the device responds unexpectedly or executes unintended commands, it may be vulnerable.

Impact Analysis

This vulnerability allows remote attackers to execute arbitrary commands on the Tenda HG10 router. Potential impacts include unauthorized access to the device, data theft, network disruption, or complete takeover of the router. Attackers could disable the device, intercept network traffic, or use it as a pivot point for further attacks.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR and HIPAA by enabling unauthorized access to sensitive data. GDPR requires protecting personal data, while HIPAA mandates securing health information. A successful exploit could result in data breaches, violating these regulations and potentially leading to legal penalties and reputational damage.

Mitigation Strategies

Immediately update the Tenda HG10 firmware to the latest patched version. If no patch is available, restrict access to the device's web interface by blocking external connections to ports 80 and 443. Disable the Boa web server if possible and monitor network traffic for suspicious POST requests to /boaform/admin/formgponConf.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-86167. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart