CVE-2026-85109

Executive Summary

CVE-2026-85109 is a critical remotely exploitable buffer overflow vulnerability in the Tenda HG10 wireless router (hardware version 300001138), specifically affecting the formLogin function within the Boa Web Server component's /boaform/formLogin endpoint. An unauthenticated attacker can trigger memory corruption by manipulating the Username argument, potentially achieving complete device compromise. The vulnerability carries a CVSS score of 9.8 (Critical) with no known patch available, and exploit code has been publicly disclosed, making active exploitation highly probable in the near term. All owners of Tenda HG10 devices with firmware version 300001138 are affected.

Technical Analysis

The NVD description identifies a buffer overflow vulnerability in the Tenda HG10 router (model identifier 300001138). The vulnerable code path resides in the formLogin function of the /boaform/formLogin file, which is handled by the Boa Web Server component. Boa is a lightweight, single-threaded HTTP web server commonly embedded in network devices such as routers and IoT hardware due to its minimal resource footprint.

Vulnerability mechanism: The formLogin function processes login authentication requests. When handling the Username argument, the function copies the user-supplied value into a fixed-size stack or heap buffer without adequate bounds checking. By supplying a Username value exceeding the destination buffer's capacity, an attacker can overwrite adjacent memory regions, including the return address (if stack-based) or function pointers (if heap-based), leading to arbitrary code execution.

Contributing factors documented for this floaw class (CWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer):

• The use of inherently unsafe string copy functions (e.g., strcpy, sprintf) without length validation — a pattern endemic to embedded C codebases that predate secure coding standards.
• Insufficient input sanitization at the web-server layer; no length limits are enforced on the Username parameter before it reaches the vulnerable function.
• The Boa server typically runs with elevated privileges (root or system) on embedded platforms, amplifying the impact of memory corruption.

Attack surface: The /boaform/formLogin endpoint is exposed on the router's administrative web interface (typically TCP port 80 or 443). Since the attack is launched remotely over the network (AV:N), no prior authentication or user interaction is required (PR:N, UI:N). The exploitation does not require special privileges or local access to the device.

Technical limitations: The NVD description does not specify whether the overflow is stack-based or heap-based, the exact size of the vulnerable buffer, or whether the Boa server runs as root. Additionally, no firmware version other than 300001138 is identified as affected or unaffected. Insufficient technical detail is available to provide function-level pseudocode or exact offset calculations for exploit development.

Exploitation Scenarios

No public PoC is available in the provided intelligence data; the attack chain is inferred from the vulnerability class (CWE-119 buffer overflow in an unauthenticated web interface).

Step 1 — Reconnaissance / Target identification: An attacker first identifies internet-facing Tenda HG10 devices. This is typically accomplished via network scanning tools (e.g., Shodan, Censys, masscan) looking for the device's default web interface banner or specific HTTP response headers associated with Boa. Once targets are enumerated, the attacker validates that the /boaform/formLogin endpoint responds with the expected authentication form, confirming the vulnerable code path is reachable.

Step 2 — Triggering the vulnerability: The attacker crafts an HTTP POST request to http://<target-ip>/boaform/formLogin with an abnormally long value in the Username field. The request requires no session cookie or prior authentication token. The malformed Username argument is then parsed by the Boa server and passed to the formLogin function, where it is copied into a fixed-size buffer without bounds validation, causing a stack or heap overflow.

Step 3 — Payload / Execution method (vulnerability-class level): For stack-based overflows: the attacker overwrites the saved return address on the stack with the address of attacker-controlled shellcode placed within the same overflow payload or at a predictable location in memory (e.g., within the Username buffer itself). Upon function return, execution redirects to the shellcode.

For heap-based overflows: the attacker corrupts adjacent heap metadata or function pointers. A common technique is overwriting a function pointer that is later called during the same request cycle, redirecting control flow to attacker-controlled data.

Because no authentication is required, the attacker does not need to bypass login credentials — the overflow itself is the entry point.

Step 4 — Post-exploitation impact: On success, the attacker achieves arbitrary code execution with the privileges of the Boa web server process — typically root on embedded Linux router platforms. This allows the attacker to:

• Install persistent backdoors (e.g., modify firmware, add cron jobs, plant a reverse shell).
• Exfiltrate sensitive data including Wi-Fi credentials, WAN/LAN configuration, and any credentials stored in configuration files.
• Enlist the device into a botnet for distributed denial-of-service (DDoS) campaigns.
• Use the router as a pivot point for lateral movement into the internal network it serves.
• Modify DNS settings to redirect traffic for credential harvesting or malware delivery.
• Disable security features or deploy malicious firmware updates.

Because the vulnerability yields C:H/I:H/A:H (Complete confidentiality, integrity, and availability impact) per the CVSS vector, the device is fully compromised and can be weaponized.

Impact Assessment

CVSS v3.1 Score: 9.8 (Critical) — Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Subscore analysis:

• Attack Vector: Network (AV:N): Remote exploitation over the internet is trivial; the vulnerable interface is exposed by design on a router.
• Attack Complexity: Low (AC:L): No specialized conditions or race windows are required; a single malformed HTTP request suffices.
• Privileges Required: None (PR:N): The login endpoint is accessible pre-authentication.
• User Interaction: None (UI:N): No victim action is needed.
• Scope: Unchanged (S:U): The compromise is contained to the device, but the device itself acts as a network gateway.
• C/I/A: High (H/H/H): Complete device compromise; the router's full functionality (routing, firewall, DNS, config) is available to the attacker.

Affected systems: Tenda HG10 routers with hardware version 300001138. The vendor has not disclosed the affected firmware version range; it is assumed that all firmware builds for this hardware revision are vulnerable until proven otherwise. No patch is available, and the vendor has not released an advisory.

Blast radius: The HG10 is a consumer-grade router typically deployed in home and small-office environments. A compromised router places the attacker at the network perimeter, effectively granting them a foothold inside the LAN. This positions the attacker to intercept traffic, compromise connected devices (PCs, phones, smart home equipment), and launch further attacks against the internal network — bypassing the router's firewall. Given the public disclosure of exploit code, the HG10 is a prime candidate for inclusion in large-scale IoT botnets (e.g., Mirai variants) that target TP-Link, D-Link, and Tenda devices.

EPSS status: Not yet scored by FIRST.org. Given a CVSS of 9.8 and publicly disclosed exploit code, the likelihood of exploitation in the wild is expected to be high once the exploit is weaponized and scanned for at scale.

Detection Guidance

The following detection rules target the exploitation of CVE-2026-85109. Since no specific payload pattern is publicly documented, these rules focus on (1) abnormally long Username parameters in HTTP POST requests to the /boaform/formLogin path, and (2) anomalous post-exploitation behavior such as reverse-shell connections or unexpected process execution on the device.

Sigma Rule

title: Tenda HG10 formLogin Buffer Overflow Attempt
id: 4a7d5c1e-8f2b-4d6a-9c3e-1a2b3c4d5e6f
status: experimental
description: Detects HTTP POST requests to /boaform/formLogin with an abnormally large Username parameter, indicating a possible buffer overflow attempt (CVE-2026-85109).
author: Valtersit Threat Intelligence
date: 2026/01/01
logsource:
  category: webserver
  product: apache
  # Adjust to match your proxy/webserver log format (e.g., nginx, haproxy, custom)
detection:
  selection_path:
    cs-method: 'POST'
    cs-uri-path: '/boaform/formLogin'
  selection_length:
    # Covers both base64 and URL-encoded payloads; typical Username is < 64 bytes.
    cs-uri-query|contains: 'Username='
    cs-uri-query|len: '> 256'
  condition: selection_path and selection_length
level: high
falsepositives:
  - Malformed clients or legitimate but long usernames (unlikely at >256 chars)
tags:
  - attack.initial-access
  - attack.t1190
  - cve.2026-85109

YARA Rule

/*
  YARA rule for CVE-2026-85109 — Tenda HG10 formLogin buffer overflow.
  Detects HTTP request payloads targeting the login endpoint with oversized Username fields.
*/
rule Tenda_HG10_FormLogin_BufferOverflow {
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detect HTTP POST to /boaform/formLogin with oversized Username parameter (CVE-2026-85109)"
        cve = "CVE-2026-85109"
        date = "2026-01-01"
        score = 85

    strings:
        $a_uri = "/boaform/formLogin" ascii nocase
        $a_user = "Username=" ascii nocase

    condition:
        // Both the vulnerable endpoint and the Username parameter must be present
        all of them and
        // Trigger on unusually large payloads (payload size > 512 bytes)
        filesize > 512
}

Suricata IDS Rule

# Suricata rule for CVE-2026-85109 — Tenda HG10 formLogin buffer overflow
# Detects oversized HTTP requests to the vulnerable login endpoint.
alert http any any -> $HOME_NET any (msg:"CVE-2026-85109 - Tenda HG10 formLogin Buffer Overflow Attempt"; flow:to_server,established; http.method; content:"POST"; http.uri; content:"/boaform/formLogin"; nocase; http.request_body; content:"Username="; nocase; isdataat:256,relative; pcre:/Username=(?:[^&\s]{257,})/i; classtype:attempted-admin; sid:2026851091; rev:1; metadata:cve CVE-2026-85109;)

Rule explanation: This rule matches on HTTP POST requests to /boaform/formLogin where the request body contains Username= followed by 257 or more characters before the next delimiter. isdataat:256,relative verifies a minimum body length, and the PCRE enforces the oversized parameter.

Elastic Detection

// EQL query for CVE-2026-85109 — detect oversized Username in HTTP POST to formLogin
// Assumes a web traffic index (e.g., filebeat-*, logs-auditd-*) with parsed HTTP fields
sequence by source.ip
  [ network where event.type == "start" and destination.port == 80 ]
  [ http where request.method == "POST" and request.uri.path == "/boaform/formLogin" and wildcard(request.body, "*Username=*") and length(request.body) > 256 ]

Splunk SPL Query

index=web sourcetype=access_* OR sourcetype=proxylog
| search method=POST "/boaform/formLogin"
| rex field=_raw "Username=(?<username_val>[^&\s]*)"
| eval username_len = len(username_val)
| where username_len > 256
| table _time, src_ip, dest_ip, uri_path, uri_query, username_len, http_user_agent
| sort - _time

Alternative network-flow based SPL (for firewall/proxy logs):

index=firewall OR index=proxy action=allowed
| search url="*/boaform/formLogin*"
| rex field=url "Username=(?<username_val>[^&\s]*)"
| eval username_len = len(username_val)
| where username_len > 256
| stats count by src_ip, dest_ip, url, username_len
| sort - count

Wazuh OSSEC Rule

<group name="web,attacks,cve_2026_85109,">
  <!-- Detect Tenda HG10 formLogin buffer overflow attempt (CVE-2026-85109) -->
  <rule id="144265" level="12">
    <if_sid>31151</if_sid>  <!-- Web server 400/500 error or generic web attack rule -->
    <match>/boaform/formLogin</match>
    <regex>Username=\S{257,}</regex>
    <description>Tenda HG10 formLogin buffer overflow attempt - CVE-2026-85109</description>
    <group>web_application_attack,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Note: The rule above assumes the parent rule 31151 (generic web attack detection) has fired. Deployments may need to adjust if_sid to match local web log collection rules. For full standalone detection, replace if_sid with a web-log source that captures the HTTP request body.

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No patch evidence from any tracked source; no vendor advisory, firmware update, or workaround has been published by Tenda for this vulnerability. Affected version scope is limited to the HG10 hardware revision 300001138, but without vendor confirmation, all HG10 units should be considered vulnerable.

1. Immediate mitigations (no vendor patch available):

• Disable remote management: If the router's web interface is reachable from the WAN side, disable remote management immediately. Most consumer routers have an option "Enable Web Management from WAN" or similar — turn it off.
• Restrict interface access: If local management is required, restrict access to the administrative interface to trusted LAN IP addresses only. Use firewall rules or the router's own access-control list.
• Network segmentation: Place the router behind a stateful firewall or an upstream ISP router that can filter traffic destined for the router's management port.
• Monitor for exploitation: Deploy the detection rules above to monitor for exploit attempts targeting /boaform/formLogin.
• Change default credentials: Although the vulnerability is pre-authentication, maintaining strong unique credentials limits post-exploitation value for attackers.
• Disable UPnP: If not needed, disable Universal Plug and Play to reduce the attack surface exposed to LAN devices that may be compromised.

2. Patch/upgrade steps:

• Contact the vendor (Tenda): Open a ticket or contact Tenda support to inquire about the availability of a patched firmware for the HG10 (hardware version 300001138). Reference CVE-2026-85109.
• Monitor vendor channels: Regularly check Tenda's official support and download pages (tenda.com.cn and tendawifi.com) for firmware updates describing security fixes.
• Firmware downgrade/replacement: Until an official patch is released, consider replacing the HG10 with a router model from a vendor with a stronger security-update track record. Consumer routers such as this are frequently abandoned after release; the lack of any vendor response to a critical RCE should be treated as a strong signal that a patch may never arrive.

3. Long-term hardening:

• Adopt a patched/reputable router: Choose routers with a published security policy and automated update mechanisms.
• Segregate IoT devices: Place IoT and networking gear on a separate VLAN with no access to critical internal systems.
• Configuration auditing: Periodically review router configuration for unauthorized changes, unexpected open ports, or new MAC addresses in the DHCP client list that might indicate a pivot or backdoor.
• Regular vulnerability scanning: Use tools such as OpenVAS, Nexpose, or router-specific scanners to periodically check network devices for known CVEs.
• Log ingestion: Forward router syslog events to a central SIEM (Wazuh, Splunk, Elastic) to enable detection of the rules above at scale.

Additional guidance: The public disclosure of exploit code combined with a CVSS score of 9.8 and no patch makes this an a active risk for exposed devices. Users who cannot immediately replace the device should strongly consider completely removing remote access to the web interface and, if feasible, disconnecting the router from the internet until a patch is available.

References

1. NVD Entry — CVE-2026-85109: https://nvd.nist.gov/vuln/detail/CVE-2026-85109 (National Vulnerability Database — official CVE record; CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
2. CWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer: https://cwe.mitre.org/data/definitions/119.html (MITRE CWE reference for the vulnerability class)
3. Tenda Support/Download Portal: https://www.tendacn.com/en/support.html (Official vendor channel — monitor for future firmware advisories; none available at report time)
4. Boa Web Server Documentation: https://www.boa.org/ (Reference for the embedded HTTP server component implicated)
5. CISA Known Exploited Vulnerabilities (KEV) Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog (No entry for this CVE at the time of writing — status: NOT listed; re-check periodically)

Threat actor campaign note: As of this report, no specific threat actor group or mass-exploitation campaign has been publicly attributed to CVE-2026-85109. However, the exploit code is publicly disclosed, and given the historical pattern of similar Tenda router vulnerabilities being absorbed into IoT botnet toolkits (e.g., Mirai-family variants) within weeks of disclosure, active in-the-wild exploitation is considered highly likely. Security teams should treat any internet-facing Tenda HG10 (hardware version 300001138) as compromised until proven otherwise and should prioritize the detection and mitigation steps above.