Description

A weakness has been identified in Tenda HG10 300001138. Affected by this issue is the function formIPv6Routing of the file /boaform/admin/formIPv6Routing of the component Boa Web Server. This manipulation of the argument destNet causes buffer overflow. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "10.0",
  "pubDate": "2026-08-30T13:16:56.267Z",
  "pubdate": "2026-08-30T13:16:56.267Z",
  "executiveSummary": "A buffer overflow vulnerability exists in the Tenda HG10 (version 300001138) device, specifically within the Boa Web Server component.\nThe vulnerability is triggered via the 'destNet' argument within the 'formIPv6Routing' function located in '/boaform/admin/formIPv6Routing'.\nThis flaw allows a remote, unauthenticated attacker to inject malicious data, potentially leading to arbitrary code execution or a denial-of-service condition by overwriting adjacent memory space on the device's stack.\nGiven that the exploit is publicly available, the risk to affected devices is critical, as attackers can leverage this vulnerability to gain unauthorized control or disrupt service remotely.\nThe attack requires no special privileges to initiate, making it a significant vector for compromise of exposed Tenda HG10 gateways.",
  "technicalDetails": "The vulnerability originates from inadequate bounds checking within the 'formIPv6Routing' function inside the Boa Web Server. The web server fails to validate the length of the 'destNet' parameter provided in the HTTP request before copying it into a fixed-length memory buffer on the stack.\nWhen an overly long string is supplied as the 'destNet' argument, a buffer overflow occurs. This overflow overwrites the function's return address and other critical control flow data stored on the stack.\nThe exploitation flow involves sending a crafted HTTP POST or GET request to the '/boaform/admin/formIPv6Routing' endpoint. The attacker includes a malicious payload in the 'destNet' parameter. The payload typically consists of padding to reach the return address offset, followed by a memory address pointing to shellcode or a ROP (Return-Oriented Programming) chain.\nBecause the Boa Web Server often operates with elevated privileges, successful exploitation typically results in full system control. The execution of arbitrary code occurs in the context of the web server process, allowing an attacker to bypass authentication, exfiltrate configuration data, or modify routing tables to facilitate man-in-the-middle attacks.\nThe vulnerability is remotely exploitable as the web interface is accessible via the network. Since the target is a networking device, it is often exposed to the WAN or LAN interfaces, increasing the attack surface. There are no authentication requirements listed for reaching the vulnerable function, meaning an unauthenticated remote actor can trigger the overflow directly.\nThe post-exploitation impact includes persistent compromise of the device firmware, the ability to pivot into the internal network, and the potential to brick the device through a malformed payload that corrupts critical memory areas, leading to instability or a kernel panic."
}