CVE-2026-85109

A vulnerability was determined in Tenda HG10 300001138. This issue affects the function formLogin of the file /boaform/formLogin of the component Boa Web Server. Executing a manipulation of the argument Username can lead to buffer overflow. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized.

Score

CVSS 3.1 9.8 Critical

Status

Deferred - cna@vuldb.com

Published

2026-09-03

Last modified

2026-09-03

Weaknesses

CWE-119, CWE-120

Affected products

• Hg10 Firmware (Tenda)

References

• https://github.com/SunnyYANGyaya/cuicuishark-sheep-fishIOT/blob/main/Tenda/HG10/bof-formLogin_username.md
• https://vuldb.com/cve/CVE-2026-85109
• https://vuldb.com/submit/891994
• https://vuldb.com/vuln/398315
• https://vuldb.com/vuln/398315/cti
• https://www.tenda.com.cn/