CVE-2026-11553 Overview
CVE-2026-11553 is a stack-based buffer overflow [CWE-119] in the Tenda HG7, HG9, and HG10 routers running firmware 300001138_en_xpon. The flaw resides in the formPPPEdit function exposed through the /boaform/formPPPEdit endpoint. Manipulation of the encodename argument triggers the overflow. The vulnerability is exploitable over the network and a public proof-of-concept has been released, increasing exposure for unpatched devices.
Critical Impact
Remote attackers with low-privileged web interface access can overflow a stack buffer in the PPPoE configuration handler, enabling memory corruption that may lead to denial of service or arbitrary code execution on the affected Tenda routers.
Affected Products
- Tenda HG7 router, firmware 300001138_en_xpon
- Tenda HG9 router, firmware 300001138_en_xpon
- Tenda HG10 router, firmware 300001138_en_xpon
Discovery Timeline
- 2026-06-08 - CVE-2026-11553 published to NVD
- 2026-06-09 - Last updated in NVD database
Technical Details for CVE-2026-11553
Vulnerability Analysis
The vulnerability is a stack-based buffer overflow in the formPPPEdit handler within the embedded boa web server used by the Tenda HG7, HG9, and HG10 xPON gateways. The handler processes PPPoE configuration submissions sent to /boaform/formPPPEdit. The encodename request parameter is copied into a fixed-size stack buffer without proper length validation, allowing an attacker to overwrite adjacent stack data, including the saved return address.
The attack vector is network-based and requires low privileges, which is consistent with an authenticated user on the device's web administration interface. Successful exploitation can corrupt control flow and impact confidentiality, integrity, and availability of the device. A public exploit referenced in the GitHub PoC Repository lowers the barrier for opportunistic attacks against exposed devices.
Root Cause
The root cause is the absence of bounds checking when the formPPPEdit function copies the user-supplied encodename value into a fixed-length stack buffer. Routines such as strcpy or sprintf are commonly used in this firmware family without length validation. Because the buffer is stack-allocated, oversized input overwrites the saved frame pointer and return address, enabling control-flow hijacking on MIPS or ARM targets common to xPON CPE hardware.
Attack Vector
An attacker reachable over the network sends a crafted HTTP POST request to /boaform/formPPPEdit containing an overlong encodename parameter. With low-privileged web credentials, the request reaches the vulnerable handler and triggers the overflow. Devices that expose the management interface to untrusted networks, including WAN-side exposure or shared LAN segments, are at elevated risk. See the GitHub Report Document for the detailed reproduction steps.
// No verified exploit code is included. See the referenced PoC repository for
// technical details on the crafted HTTP request and overflow payload.
Detection Methods for CVE-2026-11553
Indicators of Compromise
- HTTP POST requests to /boaform/formPPPEdit containing an encodename parameter whose length exceeds typical configuration values (for example, several hundred bytes or more).
- Unexpected reboots, watchdog resets, or boa web server crashes on Tenda HG7, HG9, or HG10 devices.
- Configuration changes to PPPoE settings that were not initiated by an administrator.
Detection Strategies
- Inspect web server and reverse proxy logs in front of the router for anomalously long parameter values targeting /boaform/formPPPEdit.
- Deploy network IDS rules that flag HTTP requests to /boaform/formPPPEdit with encodename values exceeding a safe length threshold.
- Correlate device crash telemetry or SNMP availability dips with prior HTTP requests to the boaform endpoints.
Monitoring Recommendations
- Forward router syslog and management-plane access logs to a centralized analytics platform for retention and search.
- Alert on any access to the device administration interface from non-management network segments.
- Track firmware versions across the fleet to identify devices still running 300001138_en_xpon.
How to Mitigate CVE-2026-11553
Immediate Actions Required
- Restrict access to the router's web administration interface to trusted management VLANs and block WAN-side exposure of /boaform/.
- Rotate administrative credentials and disable any unused or default accounts that could provide the low-privileged access required to reach the handler.
- Monitor the Tenda Official Website for an updated firmware release that addresses the formPPPEdit overflow.
Patch Information
No vendor patch has been published in the references available at the time of disclosure. Consult the VulDB CVE Report for tracking of vendor remediation status and apply firmware updates from Tenda as soon as they become available.
Workarounds
- Place affected devices behind a firewall that blocks inbound HTTP and HTTPS access to the management interface from untrusted networks.
- Disable remote management on the device if it is enabled, and require VPN access for administrative changes.
- Segment xPON CPE devices into dedicated management networks to limit who can authenticate to the web interface.
# Example: block external access to the Tenda web management interface
# Replace ROUTER_IP and MGMT_NET with values appropriate to your environment
iptables -A FORWARD -d ROUTER_IP -p tcp --dport 80 -s MGMT_NET -j ACCEPT
iptables -A FORWARD -d ROUTER_IP -p tcp --dport 80 -j DROP
iptables -A FORWARD -d ROUTER_IP -p tcp --dport 443 -s MGMT_NET -j ACCEPT
iptables -A FORWARD -d ROUTER_IP -p tcp --dport 443 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
