CVE-2026-85109

CVE-2026-85109 is a remotely exploitable buffer overflow (CWE-119/CWE-120) in the formLogin function of the Boa Web Server component on the Tenda HG10 (firmware version 300001138). An unauthenticated attacker triggers it by sending a request to /boaform/formLogin with a manipulated Username argument. Given the high confidentiality, integrity, and availability impact ratings (CVSS 4.0 score 8.9), exploitation could crash the gateway or potentially allow full compromise of the device. Any user running the affected Tenda HG10 firmware whose web management interface is reachable, including units with WAN-side/remote administration enabled, is affected. The exploit has been publicly disclosed (CVSS exploit status: proof-of-concept), though it is not yet in CISA KEV and EPSS currently estimates only a 0.6% probability of exploitation within 30 days.

What to do: Identify any Tenda HG10 devices in your environment and check whether they run firmware 300001138; apply Tenda's patched firmware when it is released, as no fixed version is specified in the advisory. In the meantime, disable WAN-side/remote management and restrict access to the device's Boa web interface (the login endpoint /boaform/formLogin) to trusted networks only. Monitor for unexplained device reboots or crashes, which may indicate exploitation attempts.