Tenda HG10 formgponConf Flaw Allows Unauthenticated Root Command Injection

Executive Summary

A critical OS command injection vulnerability (CVE-2026-86167) has been disclosed in the Tenda HG10 router, firmware version 300001138 — the same device line hit by a sibling buffer overflow, CVE-2026-86165, published the same day. This flaw lives in the formgponConf function of the Boa-based web management component, at /boaform/admin/formgponConf, and lets an attacker inject arbitrary operating-system commands via the fmgpon_loid parameter.

CVSS Score: 9.9 (CVSS 3.1) / 9.4 (CVSS 4.0)

Because the vulnerable parameter is concatenated directly into a system command without sanitization or escaping, exploitation grants command execution at whatever privilege the web server process runs under — typically root on embedded router firmware. The attack requires no authentication, can be launched remotely, and public exploit code already exists. No firmware fix is available as of publication.

Vulnerability Overview

Affected Versions

Attack Vector

1. Attacker identifies a Tenda HG10 router with the web admin interface reachable
2. Attacker sends a crafted HTTP request to /boaform/admin/formgponConf
3. The fmgpon_loid argument contains shell metacharacters and an injected command
4. The backend script concatenates fmgpon_loid directly into a system() call
   with no filtering or escaping
5. The injected command executes with the privileges of the web server process
   (typically root on embedded router firmware)
6. Attacker gains a persistent root shell on the device

Impact of Successful Exploitation

Immediate Remediation

No vendor patch exists yet, so mitigation must rely on compensating controls:

1. Restrict access to the admin web interface — never expose /boaform/ endpoints to the public internet
2. Disable remote/WAN management on the router
3. Change default administrator credentials
4. Place the router's management interface on an isolated VLAN
5. Segment IoT and network infrastructure devices away from general user traffic to limit blast radius
6. Watch Tenda's support channel closely and apply a firmware update the moment one addressing this CVE is released

Detecting Exploitation Attempts

# Watch for shell metacharacters in requests to formgponConf from a network
# vantage point that can observe traffic destined for the router
tcpdump -A -s0 host <router-ip> and port 80 | grep -i "formgponConf\|fmgpon_loid"

Detection Indicators

Post-Remediation Steps

1. Apply the vendor firmware update immediately once available
2. Factory reset the device after patching if compromise is suspected — root access may have persisted beyond a simple config change
3. Rotate all credentials stored on or accessible through the router
4. Re-verify WAN-side management remains disabled
5. Evaluate end-of-support risk for this device line given the recurring pattern of unpatched critical flaws

References

• VulDB — CVE-2026-86167 Tenda HG10 Boa formgponConf OS Command Injection
• OffSeq Threat Radar — CVE-2026-86167 OS Command Injection in Tenda HG10
• NIST NVD — CVE-2026-86167

Related Reading

• Tenda HG10 Router formURL Buffer Overflow
• Tenda CP3 OS Command Injection
• Tenda CP3 AutoAddWifi Command Injection