# CVE-2026-104610: Tenda HG7/HG9/HG10 stack buffer overflow in formLoopBack

Source: https://junglewise.ai/threats/cve-2026-104610-a-security-vulnerability-has-been-detected-in-tenda-hg7-hg9-and  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-02. Updated: 2026-10-05  
License: CC BY 4.0 with a link back

CVE-2026-104610 · Severity: critical · CVSS 10 · Published 2026-10-02

Tenda HG7, HG9, and HG10 are home Wi-Fi routers with integrated management interfaces that allow remote configuration. A stack-based buffer overflow in the web management component can be triggered remotely without authentication through a crafted parameter, allowing an attacker to crash the router's management service or potentially achieve remote code execution on the device.

Technologies: [Tenda HG10](https://junglewise.ai/threats/technologies/hg10), [Tenda HG7](https://junglewise.ai/threats/technologies/hg7), [Tenda HG9](https://junglewise.ai/threats/technologies/hg9). Vendors: [Tenda](https://junglewise.ai/threats/vendors/tenda).

## Quick answers

**Is CVE-2026-104610 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-104610 being exploited in the wild.

**How severe is CVE-2026-104610?** Critical severity, with a CVSS score of 10, published 2 October 2026.

**Which products and versions are affected?** Tenda HG10 300001138_en_xpon; Tenda HG7 300001138_en_xpon; Tenda HG9 300001138_en_xpon.

**Is there a fix for CVE-2026-104610?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-104610 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-104610?** Check whether you run Tenda HG10, Tenda HG7 or Tenda HG9 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A stack-based buffer overflow (CWE-121) exists in the Boa web server's formLoopBack handler at /boaform/formLoopBack. The vulnerable boaGetVar function does not validate the length of the user-supplied Ethtype parameter before copying it with strcpy() into a fixed stack buffer, allowing an unauthenticated remote attacker to overflow the buffer and corrupt the stack. This can result in denial of service or remote code execution with the privileges of the Boa process.

## Affected products

- Tenda HG7 300001138_en_xpon
- Tenda HG9 300001138_en_xpon
- Tenda HG10 300001138_en_xpon

## Timeline

- 2026-09-06: disclosed
- 2026-10-02: advisory

## References

- [https://github.com/Expl0rer-Ct/CVE/issues/1](https://github.com/Expl0rer-Ct/CVE/issues/1)
- [https://vuldb.com/cve/CVE-2026-104610](https://vuldb.com/cve/CVE-2026-104610)

## Related threats

- [Tenda HG10 OS command injection in formgponConf](https://junglewise.ai/threats/cve-2026-86167-tenda-hg10-os-command-injection-in-formgponconf)
- [Tenda HG10 buffer overflow in formWanRedirect](https://junglewise.ai/threats/cve-2026-86166-tenda-hg10-buffer-overflow-in-formwanredirect)
- [Tenda HG10 buffer overflow in formURL](https://junglewise.ai/threats/cve-2026-86165-tenda-hg10-buffer-overflow-in-formurl)
- [Tenda HG10 buffer overflow in formWlanSetup SSID parameter](https://junglewise.ai/threats/cve-2026-85110-tenda-hg10-buffer-overflow-in-formwlansetup-ssid-parameter)
- [Tenda HG10 buffer overflow in Boa Web Server login handler](https://junglewise.ai/threats/cve-2026-85109-tenda-hg10-buffer-overflow-in-boa-web-server-login-handler)