CVE-2026-86167

CVE-2026-86167 is an OS command injection flaw (CWE-77/CWE-78) in the formgponConf handler at /boaform/admin/formgponConf, which is served by the Boa embedded web server on Tenda HG10 GPON fiber terminals (build/version 300001138). An authenticated remote user can inject commands through the fmgpon_loid (Logical ONT ID) parameter, which the handler passes to the operating system without proper sanitization, causing arbitrary commands to execute on the device. Successful exploitation gives the attacker control of the ONT at the OS level, with high-rated confidentiality, integrity, and availability impact in CVSS 4.0 (8.6, High), including the ability to alter device configuration, disrupt fiber service, or pivot into the subscriber's local network. Affected parties are operators or subscribers of Tenda HG10 units whose Boa admin interface is reachable (over the LAN, or over the WAN where remote management is enabled), and exploitation requires valid low-privilege credentials. The advisory states that a public exploit exists and may be used, though no formal PoC is cataloged; the flaw is not yet in CISA KEV, and EPSS estimates a 1.6% (75th percentile) chance of exploitation within 30 days.

What to do: Contact Tenda or your internet provider for patched HG10 firmware, since the advisory does not specify a fixed version. Until patched, restrict exposure of the device's admin interface — disable WAN-side/remote management and limit access to trusted LAN hosts — and audit affected devices for unexpected configuration changes or signs of command execution via the formgponConf endpoint. Given the publicly available exploit and moderately elevated EPSS, prioritize devices exposed to untrusted networks.