Description

A vulnerability was determined in Tenda HG10 300001138. This issue affects the function formLogin of the file /boaform/formLogin of the component Boa Web Server. Executing a manipulation of the argument Username can lead to buffer overflow. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-09-03T14:17:04.663Z",
  "pubdate": "2026-09-03T14:17:04.663Z",
  "executiveSummary": "This vulnerability is a stack-based buffer overflow affecting the Boa Web Server component within Tenda HG10 firmware version 300001138.\nThe flaw originates from insecure handling of the 'Username' argument during a POST request to the '/boaform/formLogin' endpoint.\nA remote, unauthenticated attacker can exploit this weakness by submitting a maliciously crafted username payload to trigger memory corruption.\nSuccessful exploitation allows for the potential execution of arbitrary code with the privileges of the web server process, leading to a complete compromise of the device integrity and availability.\nGiven that the exploit has been publicly disclosed, the risk is categorized as high, necessitating immediate defensive measures to prevent remote unauthorized access.",
  "technicalDetails": "The vulnerability resides in the 'formLogin' function of the Boa Web Server, which is responsible for processing login credentials submitted via HTTP POST requests.\nThe root cause is a classic buffer overflow condition where the application fails to perform adequate bounds checking on the 'Username' input parameter before copying the user-provided data into a fixed-length stack buffer.\nWhen an overly long string is provided as the 'Username' argument, it overwrites adjacent memory on the stack, including critical control data such as the saved return address of the function.\nThe attack flow begins with the adversary sending a crafted HTTP POST request to the '/boaform/formLogin' URI. By injecting a payload exceeding the allocated buffer size, the attacker gains control over the instruction pointer upon function return.\nAs the Boa Web Server typically runs with elevated privileges in embedded Linux environments, the hijacked control flow can be redirected to execute shellcode or return-oriented programming (ROP) chains included within the request payload.\nBecause the service is reachable over the network and the vulnerable function is accessible without prior authentication, the attack vector requires no valid credentials to initiate.\nThe post-exploitation impact includes the potential for persistent code execution, enabling the adversary to maintain unauthorized access, exfiltrate sensitive configuration data, or leverage the device as a node in further internal network attacks.\nThe specific version affected is Tenda HG10 300001138, and the failure to enforce input length validation at the application layer remains the primary security oversight facilitating this memory corruption event."
}