CVE-2026-86166

A vulnerability was determined in Tenda HG10 300001138. This issue affects the function formWanRedirect of the file /boaform/formWanRedirect of the component Boa Web Server. Executing a manipulation of the argument if can lead to buffer overflow. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized.

Score

CVSS 3.1 8.8 High

Status

Deferred - cna@vuldb.com

Published

2026-09-06

Last modified

2026-09-11

Weaknesses

CWE-119, CWE-120

Affected products

• Hg10 Firmware (Tenda)

References

• https://github.com/SunnyYANGyaya/cuicuishark-sheep-fishIOT/blob/main/Tenda/HG10/bof-formWanRedirect-if.md
• https://vuldb.com/cve/CVE-2026-86166
• https://vuldb.com/submit/895595
• https://vuldb.com/vuln/399305
• https://vuldb.com/vuln/399305/cti
• https://www.tenda.com.cn/