CVE-2026-86165
A vulnerability was found in Tenda HG10 300001138. This vulnerability affects the function formURL of the file /boaform/admin/formURL. Performing a manipulation of the argument Keywd/urlFQDN results in buffer overflow. The attack may be initiated remotely. The exploit has been made public and could be used.
Scoring
- Severity
- CRITICAL
- CVSS base score
- 10
- CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
- EPSS probability
- 0.64%
- CWE
- CWE-120, CWE-119
- Published
- 2026-09-06
- Last modified
- 2026-09-08
Affected products
- Tenda HG10
Weakness type
Related vulnerabilities
- CVE-2026-87931 — Behavioral Technology Group Pavlok Behavioral Conditioning Wearable Apple Notification Center Service Event buffer overflow
- CVE-2026-44756 — Memory Corruption vulnerability in SAP Extended Passport (EPP) Processing
- CVE-2026-86166 — Tenda HG10 Boa Web Server formWanRedirect buffer overflow
- CVE-2026-85110 — Tenda HG10 Boa Web Server formWlanSetup buffer overflow
- CVE-2026-85109 — Tenda HG10 Boa Web Server formLogin buffer overflow
- CVE-2026-85031 — TOTOLINK CP450 cstecgi.cgi buffer overflow
- CVE-2026-9625 — RSLinx Classic® - Multiple Vulnerabilities
- CVE-2026-83596 — Webkitgtk: validate the full featurelist array once in opentypeverticaldata findfeature