Vulnerability · Published Sep 3, 2026 · Assigned by VulDB
CVE-2026-85109Tenda HG10 Boa Web Server formLogin buffer overflow
Critical 9.8
In plain English
A critical-severity buffer overflow in HG10 from Tenda. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 66% of all known vulnerabilities).
Severity (CVSS 3.1)9.8Critical
Exploit odds (30 days)1.1%top 34.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
A vulnerability was determined in Tenda HG10 300001138. This issue affects the function formLogin of the file /boaform/formLogin of the component Boa Web Server. Executing a manipulation of the argument Username can lead to buffer overflow. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized.
Affected products (as reported)
Weakness: CWE-120, CWE-119 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R
References
- VDB-398315 | Tenda HG10 Boa Web Server formLogin buffer overflow vdb-entry, technical-description
- VDB-398315 | CTI Indicators (IOB, IOC, IOA) signature, permissions-required
- CVE-2026-85109 | CVE Analysis and Report third-party-advisory
- Submit #891994 | Tenda HG10 HG7_HG9_HG10re_300001138 Denial of Service third-party-advisory
- https://github.com/SunnyYANGyaya/cuicuishark-sheep-fishIOT/blob/main/Tenda/HG10/bof-formLogin_username.md exploit
- https://www.tenda.com.cn/ product