CVE-2026-86165: Tenda HG10 Buffer Overflow Vulnerability

CVE-2026-86165 Overview

CVE-2026-86165 is a buffer overflow vulnerability in the Tenda HG10 router running firmware version 300001138. The flaw resides in the formURL function within the /boaform/admin/formURL endpoint. Attackers can trigger the overflow by manipulating the Keywd or urlFQDN arguments during an HTTP request to the administrative interface. The vulnerability is remotely exploitable over the network and requires no authentication or user interaction. A public exploit has been disclosed, increasing the likelihood of opportunistic attacks against exposed devices.

Critical Impact
Remote attackers can trigger memory corruption in the Tenda HG10 web management interface, potentially leading to arbitrary code execution or denial of service on the affected router.

Affected Products

Tenda HG10 router
Firmware version 300001138
Web administration interface (/boaform/admin/formURL)

Discovery Timeline

2026-09-06 - CVE-2026-86165 published to the National Vulnerability Database (NVD)
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-86165

Vulnerability Analysis

The vulnerability is a classic buffer overflow classified under CWE-119, which covers improper restriction of operations within the bounds of a memory buffer. The formURL handler in the Tenda HG10 firmware processes user-supplied values from the Keywd and urlFQDN HTTP parameters without validating their length. When these parameters exceed the fixed-size destination buffer, adjacent memory is overwritten. On embedded MIPS or ARM SoC devices such as the HG10, this typically corrupts stack frames, saved return addresses, or function pointers used by the boa web server process. The public disclosure of proof-of-concept exploitation material shortens the window defenders have to patch or isolate affected devices.

Root Cause

The underlying defect is missing bounds checking during a string copy operation inside the formURL handler. Common patterns in this class of Tenda firmware bugs involve calls to unsafe functions such as strcpy or sprintf that copy attacker-controlled query parameters directly into stack-allocated buffers. Because the router web server runs with elevated privileges, memory corruption in this process directly affects the security of the device.

Attack Vector

Exploitation requires only network access to the router's HTTP management interface. An attacker sends a crafted POST or GET request to /boaform/admin/formURL with an oversized Keywd or urlFQDN parameter. No credentials are required, and no user interaction is needed. Devices exposing the web interface to the WAN are directly reachable from the internet, while LAN-side attackers can pivot from compromised endpoints or malicious wireless clients.

A public proof-of-concept is available in the GitHub PoC Repository documenting the parameter manipulation required to reproduce the overflow. Additional technical context is available at VulDB CVE-2026-86165.

Detection Methods for CVE-2026-86165

Indicators of Compromise

HTTP requests to /boaform/admin/formURL containing unusually long Keywd or urlFQDN parameter values
Unexpected reboots, crashes, or watchdog resets of the Tenda HG10 web management daemon (boa)
Outbound connections from the router to unfamiliar IP addresses following administrative HTTP traffic
New or modified DNS, firewall, or routing configuration on the device that was not made by an administrator

Detection Strategies

Deploy network intrusion detection signatures that flag HTTP requests to /boaform/admin/ endpoints containing parameter values exceeding typical field length thresholds (for example, 256 bytes)
Monitor router-facing network segments for anomalous POST/GET traffic sourced from untrusted networks or unmanaged internal hosts
Correlate management-interface access attempts with authentication logs to identify unauthenticated requests reaching administrative handlers

Monitoring Recommendations

Alert on any WAN-side traffic destined for the router's HTTP administrative port
Baseline normal administrative traffic patterns and flag deviations in parameter lengths or request frequency
Ingest router syslog and connection telemetry into a centralized SIEM for retention and cross-correlation with endpoint activity

How to Mitigate CVE-2026-86165

Immediate Actions Required

Disable WAN-side access to the Tenda HG10 web management interface if it is currently exposed
Restrict LAN-side access to the administrative interface using access control lists that permit only trusted management hosts
Change any shared or default administrative credentials and audit recent configuration changes on affected devices
Inventory all Tenda HG10 devices running firmware 300001138 across the environment

Patch Information

At the time of publication, no vendor patch has been referenced in the NVD entry for CVE-2026-86165. Administrators should monitor the Tenda Official Website for firmware updates addressing the formURL buffer overflow. Consider replacement of the affected device if the vendor does not release a fix within an acceptable timeframe.

Workarounds

Place affected routers behind an upstream firewall that blocks unsolicited inbound HTTP requests to the management interface
Segment IoT and network infrastructure devices onto a dedicated VLAN with strict egress filtering to limit blast radius if the device is compromised
Replace end-of-support Tenda HG10 units with actively maintained hardware where feasible
Continuously monitor the router for signs of compromise, including unexpected DNS or firmware changes

bash

# Configuration example: upstream firewall rule to block WAN access
# to the Tenda HG10 administrative interface
iptables -A FORWARD -i wan0 -p tcp -d <router_lan_ip> \
  --dport 80 -j DROP
iptables -A FORWARD -i wan0 -p tcp -d <router_lan_ip> \
  --dport 443 -j DROP