CVE-2026-11498 Overview
CVE-2026-11498 is a stack-based buffer overflow [CWE-119] in the Tenda HG7HG9 and HG10 routers running firmware 300001138_en_xpon. The flaw resides in the asp_voip_OtherSet function handling requests to /boaform/voip_other_set within the Web Management Interface. Attackers manipulate the funckey_transfer argument to overflow a stack buffer. The issue is reachable over the network and requires low-level authenticated access to the management interface. Successful exploitation can corrupt the stack and lead to arbitrary code execution on the embedded device.
Critical Impact
Remote attackers with low-privilege access to the router's Web Management Interface can trigger a stack-based buffer overflow that compromises confidentiality, integrity, and availability of the affected Tenda routers.
Affected Products
- Tenda HG7 router firmware 300001138_en_xpon
- Tenda HG9 router firmware 300001138_en_xpon
- Tenda HG10 router firmware 300001138_en_xpon
Discovery Timeline
- 2026-06-08 - CVE-2026-11498 published to NVD
- 2026-06-08 - Last updated in NVD database
Technical Details for CVE-2026-11498
Vulnerability Analysis
The vulnerability exists in the asp_voip_OtherSet function that processes HTTP requests sent to the /boaform/voip_other_set endpoint of the Tenda router's web administration component. This handler accepts VoIP configuration parameters submitted through the management interface. The funckey_transfer parameter is copied into a fixed-size stack buffer without validating its length. When an attacker submits an oversized value, the copy operation writes past the buffer boundary and corrupts adjacent stack memory, including the saved return address.
The attack is reachable across the network with low privileges and without user interaction. Memory corruption of this nature on embedded MIPS or ARM router firmware typically lacks modern mitigations such as stack canaries or ASLR, increasing the likelihood of reliable remote code execution. Exploitation provides control over the router and pivot opportunities into connected networks.
Root Cause
The root cause is the absence of bounds checking on the funckey_transfer argument before it is written to a fixed-size stack buffer inside asp_voip_OtherSet. The handler trusts attacker-controlled input length, allowing the buffer write to exceed allocated space [CWE-119].
Attack Vector
An authenticated attacker sends a crafted HTTP POST request to /boaform/voip_other_set with an oversized funckey_transfer parameter value. The malformed request reaches the asp_voip_OtherSet handler, which copies the attacker-supplied data onto the stack and overruns the buffer. Technical proof-of-concept details are available in the GitHub PoC Repository and the VulDB Vulnerability Details.
Detection Methods for CVE-2026-11498
Indicators of Compromise
- HTTP POST requests to /boaform/voip_other_set containing abnormally long funckey_transfer values exceeding typical configuration sizes.
- Unexpected reboots, web server crashes, or boa daemon restarts on Tenda HG7, HG9, or HG10 routers.
- Outbound network connections initiated by the router to unfamiliar hosts following management interface activity.
Detection Strategies
- Inspect web access logs for repeated POST requests to /boaform/voip_other_set originating from a single source within a short window.
- Apply network-level intrusion detection signatures that flag oversized POST bodies targeting boaform endpoints.
- Monitor router uptime and management plane availability for anomalous restart patterns indicative of memory corruption.
Monitoring Recommendations
- Forward router syslog and web server logs to a centralized log management or SIEM platform for correlation.
- Alert on management interface access from outside the trusted administrative subnet.
- Track changes to VoIP configuration parameters and account creation events on affected devices.
How to Mitigate CVE-2026-11498
Immediate Actions Required
- Restrict access to the router's Web Management Interface to trusted internal addresses and disable WAN-side administration.
- Rotate all administrative credentials and remove unused management accounts to reduce the attacker pool capable of authenticating.
- Audit affected devices for unauthorized configuration changes, firmware modifications, or new accounts.
Patch Information
No vendor patch has been published in the references at the time of NVD publication. Monitor the Tenda Official Website for firmware updates addressing the asp_voip_OtherSet handler and apply them once available. Refer to the VulDB CVE Documentation for ongoing status updates.
Workarounds
- Block external access to TCP ports serving the router's web administration interface at the network perimeter.
- Place affected Tenda routers behind an upstream firewall and restrict the /boaform/ URI path through a reverse proxy or ACL.
- Disable the VoIP configuration functionality if it is not required for the deployment.
# Configuration example: restrict management interface access via upstream firewall
iptables -A FORWARD -p tcp -d <router_ip> --dport 80 -s <admin_subnet> -j ACCEPT
iptables -A FORWARD -p tcp -d <router_ip> --dport 80 -j DROP
iptables -A FORWARD -p tcp -d <router_ip> --dport 443 -s <admin_subnet> -j ACCEPT
iptables -A FORWARD -p tcp -d <router_ip> --dport 443 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
