LiveActive security incident?Get immediate response
CVE Record

CVE-2026-85109: Tenda HG10 Boa Web Server formLogin buffer overflow

A vulnerability was determined in Tenda HG10 300001138. This issue affects the function formLogin of the file /boaform/formLogin of the component Boa Web Server. Executing a manipulation of the argument Username can lead to buffer overflow. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized.

CriticalCVSS 10Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysiscritical

Security readout for executives and security teams

Plain-English summary

A remotely reachable login flaw in Tenda HG10 version 300001138 can overflow device memory when processing an abnormal username. The published rating is critical because no authentication or complex conditions are reported. Public proof-of-concept material increases near-term risk, but the supplied sources do not establish active attacks or confirm a vendor fix.

Executive priority

Treat internet-facing affected devices as an immediate remediation priority. Remove public management exposure, identify the full device population, and obtain vendor-supported remediation. For internally reachable devices, apply segmentation and accelerated replacement or updating. Escalate suspected crashes or unauthorized configuration changes for incident review, while recognizing that the supplied evidence does not confirm active exploitation.

Technical view

CVE-2026-85109 affects the Boa Web Server formLogin handler at /boaform/formLogin. Manipulating the Username argument can cause a buffer overflow classified under CWE-119 and CWE-120. The supplied CVSS v2 vector is 10.0, network-accessible, low-complexity, and unauthenticated, with potential confidentiality, integrity, and availability impact; however, the cited submission specifically describes denial of service.

Likely exposure

Exposure is most likely where Tenda HG10 devices running version 300001138 have their Boa login interface reachable from untrusted networks. Internet-facing administration presents the greatest concern. Internal-only devices remain exposed to compromised hosts or untrusted users on reachable network segments. The supplied evidence does not identify other Tenda models or versions as affected.

Exploitation context

A public proof of concept is referenced, so technical details may be available to attackers. The attack is reported as remotely launchable without authentication. CISA KEV status is false in the supplied bundle, and no cited evidence confirms exploitation in the wild. Public disclosure alone should not be treated as proof of active compromise.

Researcher notes

Evidence supports an unauthenticated remote buffer overflow and public proof-of-concept availability. Impact certainty is weaker: the CVSS vector asserts complete confidentiality, integrity, and availability impact, while the linked submission describes denial of service and its report confidence is unconfirmed. Do not infer reliable code execution or exploitation in the wild without additional evidence. No vendor advisory or fixed version is supplied.

Mitigation direction

  • Identify HG10 devices running version 300001138 and prioritize any with externally reachable management interfaces.
  • Block internet access to the Boa administration interface and restrict management to trusted networks.
  • Segment affected devices from sensitive systems until vendor-supported remediation is confirmed.
  • Check Tenda guidance for corrected firmware or an approved mitigation; none is identified in the supplied sources.
  • Replace affected devices if supported remediation is unavailable and exposure cannot be adequately restricted.

Validation and detection

  • Confirm each device model and exact installed version through trusted inventory or its administrative interface.
  • Test from outside trusted networks that the management login endpoint is not reachable.
  • Review device and network logs for unusual login requests, crashes, restarts, or configuration changes.
  • After remediation, verify the installed version and repeat management-interface exposure checks.
  • Monitor vendor and CVE records for revised affected-version, impact, and remediation information.
Prepared
Confidence
medium
Sources
7

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cwe · low confidence lookup

CWE-119: Exact CWE lookup

Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
cwe · low confidence lookup

CWE-120: Exact CWE lookup

Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2026-85109 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Critical
CVSS
10 (2.0)
Known Exploited
No
Published

Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C/E:POC/RL:ND/RC:UR

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

4CVSS vectors
6Timeline events
1ADP providers
7Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: pocAutomatable: yesTechnical Impact: total

CVSS vector scores

4 official scores

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
10CVSS 2.0CriticalAV:N/AC:L/Au:N/C:C/I:C/A:C/E:POC/RL:ND/RC:UR1010VulDB
9.8CVSS 3.1CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R3.95.9VulDB
9.8CVSS 3.0CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R3.95.9VulDB
9.3CVSS 4.0CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P——VulDB

Vulnerability scoring details

Base CVSS 4.0 score

9.3Critical
CVSS 4.0 vector shape for CVE-2026-85109Attack VectorAttack ComplexityAttack RequirementsPrivileges RequiredUser InteractionVS ConfidentialityVS IntegrityVS AvailabilitySS ConfidentialitySS IntegritySS Availability

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Attack Requirements
NonePresent
Privileges Required
NoneLowHigh
User Interaction
NonePassiveActive
VS Confidentiality
HighLowNone
VS Integrity
HighLowNone
VS Availability
HighLowNone
SS Confidentiality
HighLowNone
SS Integrity
HighLowNone
SS Availability
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. Source timelineVulDB

    Advisory disclosed

  2. Source timelineVulDB

    VulDB entry created

  3. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  4. Source timelineVulDB

    VulDB entry last update

  5. CVE publishedCVE Program

    The CVE record was published.

  6. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CISA-ADPCISA ADP Vulnrichment
other:ssvc

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
TendaHG10300001138Listed
Weakness

CWE details

CWE-119CWE-120

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.

CWE-119 · source CWE mapping

Improper Restriction of Operations within the Bounds of a Memory Buffer

Improper Restriction of Operations within the Bounds of a Memory Buffer represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.

Open CWE intelligenceSame-CWE CVEs
CWE-120 · source CWE mapping

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.

Open CWE intelligenceSame-CWE CVEs