CVE-2026-86167 Overview
CVE-2026-86167 is an operating system (OS) command injection vulnerability affecting the Tenda HG10 router, firmware version 300001138. The flaw resides in the formgponConf function within the /boaform/admin/formgponConf endpoint of the Boa web server component. Attackers can manipulate the fmgpon_loid parameter to inject and execute arbitrary shell commands on the underlying operating system. Remote exploitation is possible over the network, and a proof-of-concept (PoC) exploit is publicly available. The vulnerability is classified under CWE-77: Improper Neutralization of Special Elements used in a Command.
Critical Impact
Successful exploitation grants attackers arbitrary command execution on the router with the privileges of the Boa web server process, enabling full device compromise, network pivoting, and persistent implant deployment.
Affected Products
- Tenda HG10 GPON router
- Firmware version 300001138
- Boa web server component handling /boaform/admin/formgponConf
Discovery Timeline
- 2026-09-06 - CVE-2026-86167 published to the National Vulnerability Database (NVD)
- 2026-09-08 - Last updated in NVD database
Technical Details for CVE-2026-86167
Vulnerability Analysis
The vulnerability exists in the formgponConf handler of the Boa web server embedded in the Tenda HG10 device. When the endpoint /boaform/admin/formgponConf processes HTTP requests, the fmgpon_loid parameter is passed to a system-level command execution routine without adequate sanitization. Because the parameter value is concatenated into a shell command string, injected metacharacters such as semicolons, backticks, or pipes are interpreted by the shell.
An authenticated remote attacker with low privileges can execute commands in the context of the web server, which typically runs as root on consumer GPON routers. Successful exploitation allows firmware modification, credential extraction, DNS hijacking, and use of the device as a foothold for lateral movement into the internal network. The public availability of a PoC increases the likelihood of opportunistic exploitation against internet-exposed devices.
Root Cause
The root cause is improper neutralization of special elements used in an OS command [CWE-77]. The formgponConf function fails to validate or escape shell metacharacters in the fmgpon_loid HTTP parameter before passing it to a system() or equivalent shell invocation. This design flaw is common in embedded Boa-based administrative CGI handlers where developers rely on client-side validation or assume trusted input on management interfaces.
Attack Vector
Exploitation requires network reachability to the router's HTTP administrative interface and a low-privilege session. The attacker sends a crafted POST request to /boaform/admin/formgponConf with a malicious payload appended to the fmgpon_loid parameter. Shell operators embedded in the parameter break out of the intended command context and execute attacker-supplied commands. Refer to the GitHub PoC for Tenda HG10 and VulDB CVE-2026-86167 for technical reproduction details.
No verified code example is available. The vulnerability mechanism is described in prose to avoid fabrication.
Detection Methods for CVE-2026-86167
Indicators of Compromise
- HTTP POST requests to /boaform/admin/formgponConf containing shell metacharacters (;, |, `, $(), &&) in the fmgpon_loid parameter.
- Outbound connections from the router to unexpected external hosts, especially TFTP, wget, or curl callbacks that could indicate secondary payload staging.
- Unexpected new processes on the device or modifications to persistent configuration partitions after web management traffic.
Detection Strategies
- Deploy network intrusion detection signatures inspecting HTTP request bodies destined for /boaform/admin/formgponConf for shell operators.
- Correlate administrative interface authentication events with subsequent anomalous outbound router traffic to identify post-exploitation activity.
- Enable web application firewall (WAF) or reverse proxy logging in front of the router management interface where feasible, and alert on requests containing command injection patterns.
Monitoring Recommendations
- Monitor perimeter logs for exposure of the router administrative interface to untrusted networks or the internet.
- Track DNS query patterns originating from the router; command injection frequently results in resolver hijacking or beacon activity.
- Maintain an inventory of Tenda HG10 devices and their firmware versions to identify affected assets rapidly.
How to Mitigate CVE-2026-86167
Immediate Actions Required
- Restrict access to the router's HTTP administrative interface to trusted management VLANs only, blocking WAN-side access.
- Change default and administrative credentials on all Tenda HG10 devices to reduce the attack surface for the low-privilege prerequisite.
- Audit /boaform/admin/formgponConf request logs for prior injection attempts and treat any positive match as a compromise indicator.
Patch Information
At the time of publication, no vendor patch is referenced in the NVD entry. Consult the Tenda Official Website for firmware advisories and updated releases addressing the formgponConf handler. Monitor VulDB Vulnerability ID 399306 for updates on remediation status.
Workarounds
- Disable remote (WAN) management on the router and enforce administration only via a wired LAN or dedicated management VLAN.
- Place vulnerable devices behind a firewall or reverse proxy that filters HTTP requests containing shell metacharacters in the fmgpon_loid parameter.
- Replace end-of-life or unpatched Tenda HG10 units with actively supported hardware when a vendor fix is not forthcoming.
# Example firewall rule to restrict router management access to a trusted subnet
iptables -A INPUT -p tcp --dport 80 -s 192.0.2.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
