EXPOSURES › CVE-2026-86165
CVE-2026-86165
CRITICALA remote buffer overflow in Tenda HG10 router firmware allows arbitrary code execution.
Tenda HG10 routers shipped with a buffer overflow in the formURL function that can be triggered remotely via malformed URL parameters. DIB organizations must patch this immediately as it enables remote code execution, violating CMMC/NIST 800-171 requirements for patch management and system integrity. Organizations should verify firmware versions and apply vendor patches to prevent compromise.
Shame score — A critical remote code execution vulnerability in consumer/enterprise router firmware that was publicly disclosed and exploited, indicating negligent patch management and poor secure development practices.
▸ RECOMMENDED ACTION Remote code execution — patch the affected products on priority.
A vulnerability was found in Tenda HG10 300001138. This vulnerability affects the function formURL of the file /boaform/admin/formURL. Performing a manipulation of the argument Keywd/urlFQDN results in buffer overflow. The attack may be initiated remotely. The exploit has been made public and could be used.