Executive brief
The Tenda HG10 router's web administration interface contains a buffer overflow vulnerability in the formURL function. An attacker can send a specially crafted HTTP request to crash the router or potentially execute arbitrary code, rendering the device unavailable and requiring a manual restart. This affects remote network security since attackers can disable the firewall protecting an organization's internal network without authentication.
Technical details
A classic stack-based buffer overflow exists in the Boa web server's formURL handler (/boaform/admin/formURL) due to unsafe use of strcpy() when processing the "Keywd" parameter. The vulnerable code retrieves the Keywd argument from HTTP POST requests and copies it into a fixed-size buffer without length validation. An attacker can send an oversized Keywd parameter via a remote HTTP POST request to overflow the buffer, overwriting adjacent stack memory. This results in immediate denial of service (crash) and potentially code execution, depending on memory layout and exploitation sophistication. No authentication is required; the attack is network-reachable. Patches are not yet publicly available.
Affected products
- Tenda HG10 300001138
Timeline
- 2026-09-06: disclosed
- 2026-09-06: other: Exploit published on GitHub