Description

A vulnerability was identified in Tenda HG10 300001138. Impacted is the function formgponConf of the file /boaform/admin/formgponConf of the component Boa. The manipulation of the argument fmgpon_loid leads to os command injection. Remote exploitation of the attack is possible. The exploit is publicly available and might be used.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.9",
  "pubDate": "2026-09-06T05:16:50.477Z",
  "pubdate": "2026-09-06T05:16:50.477Z",
  "executiveSummary": "A critical OS command injection vulnerability exists within the Boa web server component of the Tenda HG10 device, specifically identified in the formgponConf function.\nThis vulnerability allows an unauthenticated or remote attacker to execute arbitrary system commands on the underlying operating system with elevated privileges.\nThe vulnerability arises due to improper sanitization of the fmgpon_loid argument processed by the /boaform/admin/formgponConf endpoint.\nSuccessful exploitation poses a severe risk to the device's confidentiality, integrity, and availability, potentially leading to a full system compromise, persistent backdoor installation, or the recruitment of the device into a botnet.\nThe exploit for this vulnerability is publicly documented and available, significantly increasing the risk of widespread automated exploitation by malicious actors targeting vulnerable Tenda HG10 units.",
  "technicalDetails": "The vulnerability resides within the Tenda HG10 300001138 firmware, specifically within the Boa web server component. The core issue is an OS command injection flaw located in the /boaform/admin/formgponConf URI, which handles GPON configuration updates.\nThe root cause of this vulnerability is the insecure handling of user-supplied input via the fmgpon_loid HTTP POST argument. The application fails to perform adequate input validation or sanitization before passing this argument to a system-level function or shell environment (e.g., system(), popen(), or execve()).\nAn attacker can exploit this by crafting a malicious payload injected into the fmgpon_loid field. By utilizing shell metacharacters such as semicolons (;), pipes (|), or backticks (``), an attacker can terminate the intended command and append arbitrary system commands that the underlying operating system will then execute.\nThe attack flow proceeds as follows: 1. The attacker sends a crafted HTTP POST request to the /boaform/admin/formgponConf endpoint. 2. The fmgpon_loid parameter is populated with a malicious command string designed to interface with the system shell. 3. The Boa web server processes the request, invoking the formgponConf function. 4. The function improperly concatenates the unsanitized fmgpon_loid value into a command string executed by the device’s OS. 5. The device executes the injected command with the privileges of the Boa web server process, typically root.\nSince the exploit is publicly available, attackers can leverage scripted automated tools to scan for and identify internet-facing Tenda HG10 devices. Exploitation does not necessarily require complex reconnaissance; standard network traffic directed at the specific file path is sufficient to trigger the flaw.\nPost-exploitation impact is severe, as the attacker gains the ability to execute shell commands, read/write arbitrary files, exfiltrate configuration data, or reconfigure network settings to redirect traffic. Furthermore, the attacker may establish persistence by modifying startup scripts or installing remote access trojans (RATs) to maintain long-term control over the device. The lack of robust input filtering at the entry point of the configuration management function highlights a critical failure in secure coding practices within the Boa implementation for this specific hardware release."
}