CVE-2026-86166 Overview
CVE-2026-86166 is a buffer overflow vulnerability in the Tenda HG10 router (firmware version 300001138). The flaw resides in the formWanRedirect function within /boaform/formWanRedirect, part of the embedded Boa Web Server component. An authenticated attacker can manipulate the if argument to trigger memory corruption over the network. The vulnerability is classified under [CWE-119] (Improper Restriction of Operations within the Bounds of a Memory Buffer). A public proof-of-concept has been disclosed, increasing the likelihood of exploitation attempts against exposed devices.
Critical Impact
Successful exploitation can corrupt memory in the Boa Web Server process, enabling denial of service or arbitrary code execution on the router with the privileges of the web service.
Affected Products
- Tenda HG10 router
- Firmware version 300001138
- Boa Web Server component (/boaform/formWanRedirect)
Discovery Timeline
- 2026-09-06 - CVE-2026-86166 published to NVD
- 2026-09-08 - Last updated in NVD database
Technical Details for CVE-2026-86166
Vulnerability Analysis
The vulnerability affects the formWanRedirect handler exposed by the Boa Web Server on the Tenda HG10. The handler processes HTTP form parameters submitted to /boaform/formWanRedirect without validating the length of the if argument before copying it into a fixed-size stack buffer. An attacker who can reach the router's web management interface and supply an oversized value for if can overwrite adjacent memory, including saved return addresses on MIPS or ARM-based stacks common to Tenda devices. The result is memory corruption that leads to service crash or, with a properly crafted payload, execution of attacker-controlled code in the web server context.
Root Cause
The root cause is missing bounds checking on user-supplied input, consistent with [CWE-119]. The formWanRedirect routine copies the if parameter into a buffer using an unbounded string copy operation. Because no length validation occurs prior to the copy, attacker input larger than the buffer overflows into adjacent stack memory. This class of defect is common in legacy embedded web servers such as Boa, which has not been maintained upstream since 2005.
Attack Vector
The attack is delivered as an HTTP request to /boaform/formWanRedirect on the router's management interface. The CVSS 4.0 vector indicates the attacker requires low-level privileges (PR:L), meaning valid session credentials or an authenticated administrative context are needed to reach the vulnerable handler. Exploitation is remote, requires no user interaction, and impacts confidentiality, integrity, and availability of the router. A public write-up documenting the vulnerability is available in the GitHub analysis by SunnyYANGyaya.
No verified proof-of-concept code is reproduced here. Refer to the VulDB entry for CVE-2026-86166 for additional technical context.
Detection Methods for CVE-2026-86166
Indicators of Compromise
- HTTP POST or GET requests to /boaform/formWanRedirect containing abnormally long values in the if parameter.
- Unexpected reboots, watchdog resets, or crashes of the Boa Web Server on Tenda HG10 devices.
- Configuration changes to WAN redirect settings that do not match authorized administrative activity.
Detection Strategies
- Inspect web access logs on the router or upstream proxy for requests to /boaform/formWanRedirect with parameter values exceeding expected lengths (for example, more than 128 bytes).
- Deploy network intrusion detection signatures that match oversized if parameters in requests targeting Boa Web Server endpoints.
- Monitor for authentication events preceding suspicious formWanRedirect requests to correlate credential compromise with exploitation attempts.
Monitoring Recommendations
- Forward router syslog and administrative access logs to a centralized logging platform for anomaly detection.
- Alert on management-plane access to the HG10 from untrusted network segments or external IP addresses.
- Track outbound connections from the router that could indicate post-exploitation activity such as reverse shells or C2 beaconing.
How to Mitigate CVE-2026-86166
Immediate Actions Required
- Restrict access to the router's web management interface to trusted internal management VLANs only.
- Disable remote WAN-side administration on the Tenda HG10 if it is currently enabled.
- Rotate administrative credentials on affected devices and enforce strong, unique passwords to reduce the risk of authenticated exploitation.
- Isolate the HG10 behind an upstream firewall that filters HTTP requests to /boaform/ paths from untrusted sources.
Patch Information
As of the last NVD update on 2026-09-08, no vendor patch has been published for the Tenda HG10 firmware 300001138. Consult the Tenda official website for firmware update notifications. If a vendor advisory is unavailable, consider replacing the device with a supported model that receives active security maintenance.
Workarounds
- Place the router behind a reverse proxy or web application firewall that enforces strict length limits on request parameters targeting /boaform/formWanRedirect.
- Block external access to TCP ports serving the router's web management interface at the network perimeter.
- Segment IoT and network infrastructure devices onto a management VLAN with tightly scoped access control lists.
- Where feasible, decommission unsupported Tenda HG10 units and migrate to actively maintained hardware.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
