Executive Summary
A critical, unauthenticated buffer overflow vulnerability (CVE-2026-82542) has been disclosed in the Tenda HG10 AC1200 dual-band Wi-Fi xPON ONT router running firmware 300001138. The flaw sits in the formIPv6Routing function of the device's Boa web server, exposed at /boaform/admin/formIPv6Routing. Manipulating the destNet argument with an overlong value overflows the buffer, and the issue has been assigned a CVSS score of 10.0 (Critical).
CVSS Score: 10.0 (Critical)
The vulnerability was reserved on 2026-08-29 and published on 2026-08-30. An exploit is already publicly available, meaning attackers do not need advanced reverse-engineering skills to weaponize it. Successful exploitation can crash the device (denial of service) or, depending on memory layout and mitigations present in the firmware, achieve arbitrary code execution on the router.
Vulnerability Overview
| Attribute | Value |
|---|---|
| CVE ID | CVE-2026-82542 |
| CVSS Score | 10.0 (Critical) |
| Type | Stack/Buffer Overflow → potential RCE |
| Component | Boa Web Server, formIPv6Routing handler |
| Vulnerable Parameter | destNet |
| Attack Vector | Network (remote, no authentication) |
| Privileges Required | None |
| User Interaction | None |
| Exploit Status | Public exploit available |
Affected Devices
| Vendor | Model | Firmware | Fixed Version |
|---|---|---|---|
| Tenda | HG10 (AC1200 Dualband Wi-Fi xPON ONT) | 300001138 | None published at time of writing |
This disclosure follows a string of similar Boa web server buffer overflow flaws recently reported across the Tenda HG7 / HG9 / HG10 router family (including CVE-2026-11553, CVE-2026-11499, and CVE-2026-11498), suggesting systemic, insufficient input validation across multiple admin endpoints in this firmware line rather than an isolated bug.
Attack Vector
1. Attacker identifies an internet- or LAN-exposed Tenda HG10 admin interface
2. Attacker crafts an HTTP POST to /boaform/admin/formIPv6Routing
3. The destNet parameter is set to an overlong, crafted value
4. Boa web server copies the value without adequate bounds checking
5. Buffer overflow corrupts adjacent memory / the process stack
6. Result: device crash (DoS), or code execution depending on mitigationsImpact of Successful Exploitation
| Impact | Description |
|---|---|
| Denial of Service | Router crashes or reboots, disrupting connectivity |
| Remote Code Execution | Possible depending on firmware memory protections |
| Network Pivot | A compromised router can be used to intercept or redirect LAN traffic |
| Botnet Recruitment | Unpatched, internet-exposed routers are prime targets for IoT botnets |
Remediation
Tenda has not published a fixed firmware version for CVE-2026-82542 as of this writing. Until a patch is available, treat affected devices as unmanageable from the untrusted network and apply the following mitigations:
- Disable remote/WAN administration on the HG10 — restrict the web admin interface to the LAN only.
- Block external access to the admin interface at the perimeter firewall (do not port-forward the management port).
- Segment IoT/router management onto a VLAN isolated from trusted devices.
- Check for firmware updates regularly via the Tenda support portal, and apply any release addressing this CVE as soon as it ships.
- Replace end-of-life hardware — the HG10 firmware line has now accumulated multiple unauthenticated overflow disclosures; organizations with compliance requirements should budget for replacement if Tenda does not ship a fix.
Detection
| Indicator | Description |
|---|---|
Unusual POST requests to /boaform/admin/formIPv6Routing | Possible exploitation attempt |
Oversized destNet values in request logs | Signature of the overflow payload |
| Unexpected router reboots or connectivity drops | Possible DoS exploitation |