CVE-2026-86165

CVE-2026-86165 is a remotely triggerable buffer overflow (CWE-119/CWE-120) in the formURL function of the admin web interface of the Tenda HG10 router/gateway, reachable through the /boaform/admin/formURL endpoint on firmware version 300001138. An attacker triggers the flaw by sending a crafted value in the Keywd/urlFQDN parameter, which overflows an internal buffer; the advisory indicates no privileges or user interaction are required (CVSS 4.0: 8.9, High). Per the CVSS scoring, successful exploitation carries high impact to the device's confidentiality, integrity, and availability — typically a crash or potential code execution — although the advisory does not confirm a specific attacker gain such as full RCE. Only deployments running the Tenda HG10 with the cited firmware whose admin web interface is reachable from an untrusted network are affected. The advisory states the exploit has been made public and could be used, but the flaw is not yet listed in CISA's KEV and EPSS currently estimates only a 0.6% probability of exploitation in the next 30 days.

What to do: Inventory networks for Tenda HG10 gateways and check whether the management web interface is exposed to the WAN or untrusted LAN segments, restricting /boaform admin endpoints to trusted management hosts. No fixed firmware version is given in the advisory, so contact Tenda or the supplying ISP for a patched build. As interim mitigation, disable WAN-side administration of affected units and monitor them for unexplained crashes or reboots.