Description

A vulnerability was found in Tenda HG10 300001138. This vulnerability affects the function formURL of the file /boaform/admin/formURL. Performing a manipulation of the argument Keywd/urlFQDN results in buffer overflow. The attack may be initiated remotely. The exploit has been made public and could be used.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-09-06T04:18:32.523Z",
  "pubdate": "2026-09-06T04:18:32.523Z",
  "executiveSummary": "A remote buffer overflow vulnerability exists in Tenda HG10 (version 300001138) within the administrative web interface. The flaw resides in the handling of user-supplied input to the 'Keywd' and 'urlFQDN' parameters processed by the 'formURL' function.\nThis memory corruption vulnerability allows an unauthenticated or remote attacker to inject arbitrary data into the system's memory stack, potentially leading to a crash (Denial of Service) or the execution of arbitrary code with administrative privileges.\nGiven that the exploit code has been made public, the risk of exploitation is significantly elevated. Attackers can reach the vulnerable component directly via the device's web management interface over the network. Successful exploitation bypasses standard application controls, granting the attacker control over the device's execution flow. Security administrators should treat this as a high-severity incident due to the potential for full device compromise and the public availability of functional exploit material.",
  "technicalDetails": "The vulnerability is a stack-based buffer overflow located in the 'formURL' function within the '/boaform/admin/formURL' component of the Tenda HG10 web server. The root cause is a lack of proper boundary checking when the application processes HTTP POST requests containing the 'Keywd' or 'urlFQDN' parameters.\nIn the vulnerable code, the device utilizes a fixed-length stack buffer to store input received via these parameters. When an attacker submits an HTTP request containing a specially crafted, oversized string to these arguments, the application fails to validate the length of the input before performing a memory copy operation, such as a 'strcpy' or 'memcpy' variant. This lack of bounds checking allows the input to exceed the allocated stack frame size, resulting in a stack buffer overflow.\nThe attack flow proceeds as follows: First, the attacker identifies the target Tenda HG10 device and accesses the web management interface. Second, the attacker crafts an HTTP request, typically a POST request, targeting the '/boaform/admin/formURL' path. The attacker embeds a malicious payload into the 'Keywd' or 'urlFQDN' argument. This payload is designed to fill the local buffer, overwrite the saved return address on the stack, and redirect the instruction pointer (EIP/RIP) to an attacker-controlled memory location.\nBecause the payload includes shellcode or return-oriented programming (ROP) chains, the attacker can redirect program execution to execute unauthorized code. If the target device lacks modern binary protections like Data Execution Prevention (DEP/NX) or Address Space Layout Randomization (ASLR), the attacker can execute arbitrary machine code directly from the stack or trigger a return to libc.\nPost-exploitation, an attacker can achieve persistent unauthorized access, modify system configurations, intercept network traffic, or force a device reset, resulting in a complete compromise of the router. The vulnerability is reachable over the network without requiring prior authentication, making it a critical threat to any exposed Tenda HG10 device."
}