Vulnerability · Published Sep 6, 2026 · Assigned by VulDB
CVE-2026-86166Tenda HG10 Boa Web Server formWanRedirect buffer overflow
High 8.8
In plain English
A high-severity buffer overflow in HG10 from Tenda. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 58% of all known vulnerabilities).
Severity (CVSS 3.1)8.8High
Exploit odds (30 days)0.9%top 41.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
A vulnerability was determined in Tenda HG10 300001138. This issue affects the function formWanRedirect of the file /boaform/formWanRedirect of the component Boa Web Server. Executing a manipulation of the argument if can lead to buffer overflow. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized.
Affected products (as reported)
Weakness: CWE-120, CWE-119 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R
References
- VDB-399305 | Tenda HG10 Boa Web Server formWanRedirect buffer overflow vdb-entry, technical-description
- VDB-399305 | CTI Indicators (IOB, IOC, IOA) signature, permissions-required
- CVE-2026-86166 | CVE Analysis and Report third-party-advisory
- Submit #895595 | Tenda HG10 HG7_HG9_HG10re_300001138 Denial of Service third-party-advisory
- https://github.com/SunnyYANGyaya/cuicuishark-sheep-fishIOT/blob/main/Tenda/HG10/bof-formWanRedirect-if.md exploit
- https://www.tenda.com.cn/ product