CVE-2026-86166

CVE-2026-86166 is a remotely exploitable buffer overflow (CWE-119/CWE-120) in the formWanRedirect function of the Boa Web Server component on Tenda HG10 routers running the 300001138 firmware. An attacker triggers it by sending a crafted request to the /boaform/formWanRedirect endpoint in which the "if" argument is manipulated to overflow a buffer; the CVSS 4.0 vector indicates the attack is network-based, requires low privileges, and needs no user interaction. Successful exploitation corrupts memory with high impact on the device's confidentiality, integrity, and availability, potentially enabling arbitrary code execution or a crash of the router's web service, although the advisory does not specify the exact primitive gained. Any Tenda HG10 unit on firmware 300001138 whose Boa web interface is reachable — particularly from the WAN — is affected. The exploit has been publicly disclosed and may be used, but the flaw is not in CISA's KEV catalog, no separate PoC is catalogued, and EPSS assigns only a 0.5% probability of exploitation within 30 days.

What to do: Check Tenda's support channels for HG10 firmware newer than 300001138 and upgrade as soon as a release is available; do not expose the router's web management interface to the internet in the meantime. Restrict WAN-side access to the Boa service (e.g., disable remote management or firewall /boaform/) and monitor for requests to /boaform/formWanRedirect carrying unusually long or malformed "if" parameter values. Since the exploit is publicly disclosed, prioritize remediation for any HG10 units reachable from the WAN.