CVE-2026-104610

Executive Summary

CVE-2026-104610 is a critical, remotely exploitable stack-based buffer overflow in the Boa web server component of Tenda HG7, HG9, and HG10 GPON/xPON optical network terminal (ONT) devices running firmware 300001138_en_xpon. The flaw resides in the boaGetVar function and is reachable via the /boaform/formLoopBack endpoint, where manipulation of the Ethtype argument overflows a stack buffer. With a CVSS base score of 10.0, no authentication requirement, and a publicly disclosed exploit, any internet-exposed or LAN-reachable device is at immediate risk of full compromise.

Technical Analysis

The vulnerability is classified as CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer), with the NVD description specifying the operative sub-class as a stack-based buffer overflow.

Attack surface components (all named verbatim in the advisory):

• Component: Boa Web Server — the embedded HTTP daemon historically used across Tenda and other consumer/SOHO CPE firmware for the administrative web interface.
• Vulnerable function: boaGetVar — Boa's variable-parsing routine, which extracts request parameters (typically from POST body or query strings) so they can be consumed by backend form handlers. This function is a classic sink for unbounded copies into fixed-size stack buffers.
• Reachable endpoint: /boaform/formLoopBack — a form handler exposed by the device's administrative interface.
• Controlled argument: Ethtype — the attacker-influenced input that is copied into the vulnerable stack buffer without adequate length validation.

Mechanism at the vulnerability-class level: A stack buffer of fixed size is allocated within the request-processing path for formLoopBack. When boaGetVar retrieves the attacker-supplied Ethtype value, the copy operation exceeds the buffer's capacity. Because the overflow occurs on the stack, adjacent memory — including saved registers and the function return address — can be overwritten. A carefully crafted Ethtype payload can therefore redirect control flow when the affected function returns, enabling arbitrary code execution in the context of the Boa daemon (typically root on embedded CPE).

No specific buffer size, delimiter, or byte offset is disclosed in the advisory. Any precise offset or ROP/gadget detail would be speculative and is therefore not asserted here.

The CVSS vector is uniquely severe: AV:N (network-reachable), AC:L (no special conditions), PR:N (no credentials), UI:N (no user interaction), and critically S:C (scope changed) — meaning successful exploitation of the web service compromises components beyond the vulnerable service itself, consistent with achieving host-level control over the ONT firmware.

Exploitation Scenarios

No vendor or third-party technical analysis beyond the advisory text was provided. The following attack chain is derived strictly from the disclosed vulnerability class (pre-authentication stack buffer overflow via a web form argument) and the named components.

1. Reconnaissance / target identification. The adversary scans for internet-exposed or LAN-adjacent Tenda HG7/HG9/HG10 administrative interfaces. Fingerprinting relies on the presence of the Boa web server and the /boaform/ handler namespace in HTTP responses (see Shodan dorks in metadata).

2. Triggering the flaw. The attacker issues an HTTP request to /boaform/formLoopBack that supplies an oversized Ethtype argument. Because the bug is pre-authentication (PR:N), no credential harvesting or session establishment is presumed necessary for the initial trigger. The Ethtype value is passed into boaGetVar, which copies it into the fixed-size stack buffer — overflowing it.

3. Payload / execution (vulnerability-class level). A stack-based buffer overflow allows overwriting of the saved return address. The attacker crafts the Ethtype payload to control the overwritten control data, aiming to redirect execution to attacker-chosen code or existing code (return-oriented) within the Boa process. The advisory states only that manipulation of Ethtype "leads to" the overflow; specific payload structure is not disclosed.

4. Post-exploitation impact. Given S:C, C:H, I:H, and A:H, successful exploitation yields high-confidentiality, high-integrity, and high-availability impact on the device — i.e., full compromise of the ONT. Practical consequences include persistent firmware-level access, interception or redirection of subscriber traffic, and use of the device as a pivot into the LAN or as a botnet node.

The advisory explicitly notes the exploit "has been disclosed publicly and may be used." Per the supplied intelligence, no exploit code, PoC file, or Nuclei template was included in the tracked dataset, so the precise payload is not reproduced here.

Impact Assessment

• Base score: 10.0 (Critical) — the maximum possible.
• Confidentiality (C:H): Sensitive CPE data, configuration, and potentially subscriber traffic accessible.
• Integrity (I:H): Firmware/config can be modified; traffic manipulation possible.
• Availability (A:H): Device can be crashed or rendered inoperable (DoS is a guaranteed side effect of an unchecked overflow even before RCE).
• Scope Changed (S:C): Impact extends beyond the vulnerable Boa service to other host components — a strong indicator of full-device compromise.
• Blast radius: Every deployed Tenda HG7, HG9, and HG10 running firmware 300001138_en_xpon is affected. These are carrier-deployed ONTs (xPON), so exposure is not limited to the end user — the ISP/carrier network may inherit risk if intruder-controlled ONTs sit at the network edge. Unauthenticated, network-reachable, and with public exploit availability, mass exploitation via automated scanners is highly plausible.
• Temporal context: No patch exists (0/4 patch confidence), the software is not in CISA KEV, and no EPSS score has yet been published — meaning defenders cannot rely on either an upstream fix or an official exploit-adoption signal; treat as actively dangerous by default.

Detection Guidance

Sigma Rule

title: Tenda Boa Web Server Stack Buffer Overflow via formLoopBack Ethtype
id: 6f2e9a41-tenda-cve-2026-104610
status: experimental
description: Detects HTTP requests to the Boa web server formLoopBack handler with an oversized Ethtype argument, consistent with CVE-2026-104610 (stack-based buffer overflow).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-104610
author: valtersit.com
logsource:
  category: webserver
detection:
  selection_uri:
    cs-uri-stem|contains: '/boaform/formLoopBack'
  selection_arg:
    cs-uri-query|contains: 'Ethtype='
  selection_len:
    cs-uri-query|re: 'Ethtype=.{100,}'
  condition: selection_uri and (selection_arg or selection_len)
fields:
  - c-ip
  - cs-uri-stem
  - cs-uri-query
falsepositives:
  - Legitimate management traffic to the ONT administrative interface (rare, short values only)
level: critical

YARA Rule

rule CVE_2026_104610_Tenda_Boa_Ethtype_Overflow
{
    meta:
        description = "Detects HTTP requests targeting the Tenda Boa formLoopBack handler with an oversized Ethtype parameter (CVE-2026-104610)"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-104610"
        date = "2026-01-01"
        severity = "critical"

    strings:
        $uri  = "/boaform/formLoopBack" ascii nocase
        $arg  = "Ethtype=" ascii nocase
        $sig  = "boaGetVar" ascii nocase

    condition:
        uint16be(0) == 0x4854 and   // "HT" (HTTP request start)
        $uri and $arg
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-104610 Tenda Boa formLoopBack Ethtype Stack Buffer Overflow Attempt"; flow:established,to_server; http.uri; content:"/boaform/formLoopBack"; http.uri; content:"Ethtype="; pcre:"/Ethtype=[^&\\s]{100,}/i"; reference:cve,2026-104610; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-104610; classtype:attempted-admin; sid:2026104610; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=5s
  [ network where http.request.method == "POST" and url.path == "/boaform/formLoopBack" ]
  [ network where http.request.body contains "Ethtype=" and length(http.request.body) > 120 ]

Splunk SPL Query

index=web OR index=proxy
| eval uri = coalesce(uri, url, cs_uri_stem)
| eval query = coalesce(query, cs_uri_query, url)
| where like(uri, "%/boaform/formLoopBack%") AND like(query, "%Ethtype=%")
| eval eth_len = len(mvindex(split(query, "Ethtype="), 1))
| where eth_len >= 100
| table _time, src_ip, dest_ip, uri, query, eth_len
| sort - _time

Wazuh OSSEC Rule

<group name="web,tenda,cve-2026-104610,">
  <rule id="104610" level="12">
    <if_sid>31100</if_sid>
    <match>/boaform/formLoopBack</match>
    <regex>Ethtype=</regex>
    <description>CVE-2026-104610: Tenda Boa formLoopBack Ethtype parameter access - possible stack buffer overflow attempt</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_104610,exploit_attempt,</group>
  </rule>

  <rule id="104611" level="15">
    <if_sid>104610</if_sid>
    <regex>Ethtype=\S{100,}</regex>
    <description>CVE-2026-104610: Oversized Ethtype payload sent to Tenda Boa formLoopBack - active exploitation likely</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_104610,exploit_attempt,critical,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No vendor fix, advisory, or upgrade path was identified from any tracked source. Affected versions list is empty and no workarounds are published.

1. Immediate mitigations

   • Remove all internet exposure of the device management interface. Block inbound access to the ONT administrative UI (including /boaform/) at the carrier/edge firewall and at the consumer router.
   • Restrict management to a trusted management VLAN/ACL with source-IP allow-listing. Segmentation alone reduces the network-reachable (AV:N) attack surface.
   • If the interface cannot be disabled, apply virtual patching: deploy the Suricata/Sigma/Wazuh detections above inline (IPS mode) to block requests to /boaform/formLoopBack carrying an Ethtype parameter.
   • Disable remote management and UPnP/TR-069 exposure where carrier policy permits.

2. Patch / upgrade steps

   • No patched firmware exists as of this assessment. Monitor Tenda's security advisory channel and the device's carrier firmware channel for a release addressing 300001138_en_xpon.
   • Until a fix is available, treat the device as compromised-capable and isolate it; if a fix is released, upgrade promptly and verify the firmware version post-upgrade.

3. Long-term hardening

   • Push vendors/carriers to replace boaGetVar-style unbounded parsing with length-validated input handling; where possible, migrate off the legacy Boa web server entirely.
   • Insist on firmware supply-chain assurances (signed firmware, SBOM) for carrier-deployed CPE.
   • Deploy network-layer monitoring for all CPE management endpoints and maintain asset inventory of ONT models/firmware versions.
   • Establish continuous CVE monitoring for edge CPE; carrier-managed ONTs should be enrolled in a fleet-wide vulnerability program rather than managed per-subscriber.

References

• NVD — CVE-2026-104610: https://nvd.nist.gov/vuln/detail/CVE-2026-104610
• MITRE CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer): https://cwe.mitre.org/data/definitions/119.html
• MITRE ATT&CK T1190 (Exploit Public-Facing Application): https://attack.mitre.org/techniques/T1190/
• Tenda security/software support portal (vendor firmware/advisory channel): https://www.tenda.com.cn/ — check for HG7/HG9/HG10 firmware updates referencing 300001138_en_xpon
• CISA Known Exploited Vulnerabilities Catalog (current status: not listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No threat actor campaign or confirmed in-the-wild exploitation activity was provided in the supplied intelligence. The advisory states only that the exploit "has been disclosed publicly and may be used."