Executive Summary
A critical buffer overflow vulnerability (CVE-2026-86165) has been disclosed in the Tenda HG10 router, firmware version 300001138. The flaw sits in the formURL function of the device's embedded web management interface, reachable at /boaform/admin/formURL, and stems from a failure to bounds-check the Keywd/urlFQDN parameters before copying them into a fixed-size buffer.
CVSS Score: 9.8 (CVSS 3.1) / 9.3 (CVSS 4.0)
The vulnerability can be triggered remotely with no authentication, and public exploit code is already available. As of publication, Tenda has not released a firmware fix.
Vulnerability Overview
| Attribute | Value |
|---|---|
| CVE ID | CVE-2026-86165 |
| CVSS 3.1 Score | 9.8 (Critical) |
| CVSS 4.0 Score | 9.3 (Critical) |
| CWE | CWE-120 (Buffer Copy Without Checking Size of Input) |
| Component | /boaform/admin/formURL |
| Vulnerable Parameters | Keywd, urlFQDN |
| Attack Vector | Network (no authentication required) |
| Exploit Status | Public exploit code available |
| Patch Status | No vendor fix available at time of writing |
Affected Versions
| Product | Affected Firmware | Fixed Version |
|---|---|---|
| Tenda HG10 | 300001138 | None available |
Attack Vector
1. Attacker identifies a Tenda HG10 router with the web admin interface reachable
2. Attacker sends a crafted HTTP request to /boaform/admin/formURL
3. Keywd or urlFQDN argument contains a string exceeding the allocated buffer size
4. The Boa-based web server copies the oversized input without bounds checking
5. Adjacent memory is corrupted, potentially overwriting the return address
6. Depending on exploitation reliability, this may crash the service (DoS)
or be leveraged for remote code execution on the deviceImpact of Successful Exploitation
| Impact | Description |
|---|---|
| Denial of Service | Reliable crash of the router's web management service |
| Remote Code Execution | Memory corruption may be leveraged for arbitrary code execution |
| Device Takeover | Full control of the router, including traffic interception |
| Botnet Recruitment | Compromised routers are commonly conscripted into DDoS botnets |
| Network Pivot Point | A compromised router sits inline with all connected LAN traffic |
Immediate Remediation
Since no official patch exists yet, mitigation is entirely compensating-control based:
- Restrict access to the admin web interface — never expose it to the public internet
- Disable remote/WAN management on the router if enabled
- Change default credentials if not already changed
- Segment the router's admin plane on a management VLAN separate from user traffic
- Monitor for crash loops or unexpected reboots of the device, which may indicate exploitation attempts
- Check Tenda's support site regularly for a firmware update addressing this CVE and apply it as soon as it is released
Detecting Exploitation Attempts
# From a network vantage point that can see traffic to the router's admin interface,
# watch for abnormally long Keywd/urlFQDN values in requests to formURL
tcpdump -A -s0 host <router-ip> and port 80 | grep -i "formURL"Detection Indicators
| Indicator | Description |
|---|---|
Oversized Keywd/urlFQDN values in HTTP requests | Exploitation attempt against formURL |
| Unexpected router reboots or watchdog resets | Possible crash from a failed/successful exploit |
| Anomalous outbound traffic from the router itself | Signs of a compromised device joining a botnet |
| Admin interface reachable from WAN | Exposure that makes exploitation possible remotely |
Post-Remediation Steps
- Apply the vendor firmware update as soon as Tenda publishes one
- Rotate the router's admin credentials after patching
- Re-verify that WAN-side management remains disabled
- Audit the router for unauthorized configuration changes (DNS settings, port forwards, added admin users)
- Consider replacing end-of-support Tenda hardware if this device is no longer receiving regular security updates
References
- VulDB — CVE-2026-86165 Tenda HG10 formURL Buffer Overflow
- OffSeq Threat Radar — CVE-2026-86165 Buffer Overflow in Tenda HG10
- NIST NVD — CVE-2026-86165