Description

A vulnerability was identified in Tenda HG10 300001138. Impacted is the function formWlanSetup of the file /boaform/formWlanSetup of the component Boa Web Server. The manipulation of the argument ssid leads to buffer overflow. Remote exploitation of the attack is possible. The exploit is publicly available and might be used.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-09-03T14:17:05.493Z",
  "pubdate": "2026-09-03T14:17:05.493Z",
  "executiveSummary": "A critical security vulnerability exists within the Boa Web Server component of the Tenda HG10 (version 300001138).\nThe flaw is categorized as a buffer overflow, stemming from improper validation of the 'ssid' argument passed to the 'formWlanSetup' function.\nThis vulnerability allows remote, unauthenticated attackers to trigger memory corruption, potentially leading to arbitrary code execution or a denial-of-service condition.\nThe risk is significantly elevated due to the public availability of exploit code, which lowers the barrier for malicious actors to compromise the device.\nSuccessful exploitation allows an attacker to manipulate the execution flow of the web server process, potentially gaining unauthorized control over the affected device.\nThe vulnerability is remotely exploitable, requiring no prior authentication, and represents a high risk to the confidentiality, integrity, and availability of the Tenda HG10 hardware.",
  "technicalDetails": "The vulnerability resides in the 'formWlanSetup' function, located within the '/boaform/formWlanSetup' handler of the Boa Web Server implementation used by the Tenda HG10.\nThe root cause is a classic buffer overflow condition resulting from the lack of bounds checking on input provided via the 'ssid' argument during the processing of HTTP POST requests.\nWhen a user submits wireless configuration settings, the application captures the 'ssid' parameter. The vulnerable code path fails to verify that the length of the supplied SSID string fits within the allocated memory buffer.\nBy crafting a specially designed, oversized 'ssid' payload, an attacker can exceed the bounds of the destination buffer on the stack or in the heap (depending on the memory layout of the specific implementation).\nThis overflow permits the overwriting of adjacent memory, including critical data structures such as saved frame pointers and return addresses.\nThe exploitation flow initiates when an unauthenticated remote attacker sends an HTTP POST request to the '/boaform/formWlanSetup' endpoint containing the malicious 'ssid' argument.\nOnce the buffer is overflowed, the attacker can redirect the instruction pointer to arbitrary locations in memory by controlling the overwritten return address.\nThis can be utilized to execute a Return-Oriented Programming (ROP) chain or jump to injected shellcode, ultimately leading to arbitrary code execution within the context of the Boa Web Server process.\nGiven that Boa Web Server typically runs with elevated privileges on embedded devices, this compromise may grant the attacker full administrative control over the underlying Linux-based system.\nThe availability of public exploit code confirms that this mechanism is well-understood and trivial to replicate by threat actors targeting this device.\nThe exposure is network-based, meaning any interface with access to the web management interface of the Tenda HG10 can potentially be leveraged for this attack."
}