CVE-2026-11553

A vulnerability was found in Tenda HG7, HG9 and HG10 300001138_en_xpon. This affects the function formPPPEdit of the file /boaform/formPPPEdit. The manipulation of the argument encodename results in stack-based buffer overflow. The attack can be launched remotely. The exploit has been made public and could be used.

Score

CVSS 3.1 8.8 High

Status

Deferred - cna@vuldb.com

Published

2026-06-08

Last modified

2026-10-02

Weaknesses

CWE-119, CWE-121

Affected products

• Hg10 (Tenda)
• Hg7 (Tenda)
• Hg9 (Tenda)

References

• https://vuldb.com/vuln/369163
• https://vuldb.com/vuln/369163/cti
• https://vuldb.com/cve/CVE-2026-11553
• https://vuldb.com/submit/836778
• https://github.com/xiezhihua-1127/Tenda-Stack-Overflow.git
• https://github.com/xiezhihua-1127/Tenda-Stack-Overflow/blob/main/report.md
• https://www.tenda.com.cn/