Executive brief
The Tenda HG10 is a residential router/modem combo that delivers internet connectivity and Wi-Fi to homes and small offices. An unauthenticated attacker can inject shell commands through the router's web administration interface, gaining the ability to execute arbitrary commands on the device—including powering it off, stealing configuration data, or using it as a foothold for lateral network attacks. No authentication is required to exploit this vulnerability.
Technical details
The vulnerability is a classic OS command injection flaw in the Boa web server's formgponConf endpoint. The fmgpon_loid POST parameter is taken directly from user input and concatenated into a system command without proper validation, escaping, or filtering. An attacker can inject shell metacharacters (e.g., semicolons, pipes) to alter command execution flow and run arbitrary system commands. The vulnerability is remotely exploitable over the network without authentication, and a public proof-of-concept exists that demonstrates device shutdown via injected poweroff command.
Affected products
- Tenda HG10 300001138
Timeline
- 2026-09-06: disclosed
- exploited: Public proof-of-concept available