CVE-2026-85110

Executive Summary

CVE-2026-85110 is a critical buffer overflow vulnerability affecting the Tenda HG10 router (hardware version 300001138). The flaw resides in the formWlanSetup function within the Boa Web Server component, specifically triggered by manipulating the ssid argument in the /boaform/formWlanSetup endpoint. Successful exploitation allows remote attackers to achieve arbitrary code execution with full system control, as reflected in the CVSS 3.1 score of 8.8 (High). The affected product is the Tenda HG10 router, an SOHO network device. Given that the exploit is publicly available and no patch exists (patch confidence 0/4), vulnerable devices are at immediate risk, enabling attackers to take complete control of both the network gateway and all traffic traversing it.

Technical Analysis

The vulnerability is classified under CWE-119, indicating improper restriction of operations within the bounds of a memory buffer. The NVD description confirms the vulnerability exists in the formWlanSetup function of the Boa Web Server component, accessed via the /boaform/formWlanSetup file. The vulnerable argument is ssid, and manipulating it causes a buffer overflow condition.

From a vulnerability mechanism standpoint, this is a classic stack-based or heap-based buffer overflow in an embedded web server handling user-supplied input. The Boa Web Server is a lightweight, single-threaded HTTP server widely deployed in embedded systems, including consumer routers. In the Tenda HG10, it handles configuration management through boaform CGI endpoints. The formWlanSetup function processes Wi-Fi configuration parameters, including the SSID name.

The attack mechanism involves sending an HTTP request to /boaform/formWlanSetup with an excessively long ssid parameter value. The absence of proper bounds checking on the ssid argument allows the attacker-supplied string to overwrite adjacent memory regions. This could corrupt stack frames, overwrite return addresses, or smash heap metadata, depending on the buffer's memory allocation. Remote exploitation of the attack is possible per the NVD description, though it requires low-privilege authentication (CVSS AV:N/AC:L/PR:L/UI:N), meaning an attacker needs only valid low-level credentials or possibly default credentials to reach the vulnerable function.

The cumulative impact rating (C:H/I:H/A:H) indicates full confidentiality, integrity, and availability loss. In practice, successful exploitation allows an attacker to execute arbitrary code in the context of the Boa Web Server process, which in most embedded router firmware runs with root privileges. This provides complete control over the device, including the ability to read or modify Wi-Fi credentials, LAN/DNS settings, and to intercept or redirect network traffic. The attack surface is significant given that Tenda HG10 routers are commonly deployed in residential and small business environments, and their web management interfaces are accessible over the LAN, sometimes exposed to the WAN via UPnP or poor firewall configurations.

Notably, no specific technical details regarding the overflow type (stack vs. heap), exact buffer size, or memory layout are available in the provided data. Insufficient technical detail is available to describe the precise vulnerable code path or the exact offset where the overflow occurs.

Exploitation Scenarios

Note: No public PoC code details were provided in the intelligence data. The attack chain described below is inferred from the vulnerability class (CWE-119 buffer overflow) and the NVD description.

Step 1: Reconnaissance and Target Identification Attackers scan for Tenda HG10 devices using network reconnaissance tools such as Shodan, Censys, or masscan. They search for devices exposing the Boa Web Server on TCP port 80 (or 8080) with a distinctive "Tenda" or "HG10" identification string in the HTTP banner or login page. Once a target is identified, attackers test for default or weak credentials, given the low-privilege requirement (PR:L) in the CVSS vector. Many SOHO router devices ship with default credentials such as admin/admin, and users frequently fail to change them.

Step 2: Triggering the Vulnerability The attacker authenticates to the web management interface and crafts an HTTP request to /boaform/formWlanSetup with an ssid parameter that exceeds the expected buffer size. The request is typically formatted as a POST or GET (depending on how the form handler parses arguments), where the oversized ssid value is designed to overflow the stack or heap buffer. Because the Boa Web Server in such embedded devices often fails to enforce length limits on configuration parameters, the malicious string is passed unchecked to formWlanSetup, overwriting adjacent memory.

Step 3: Payload Execution At the vulnerability-class level, the attacker must craft a payload that overwrites a critical control-flow structure. For a stack overflow, this involves overwriting the saved return address or a function pointer to redirect execution to attacker-controlled code. For heap overflows, this often involves heap grooming to overwrite an adjacent chunk's metadata or a function pointer. Since the exploit is publicly available and might be used per the NVD description, a functional exploit chain likely exists. Typical payloads for MIPS or ARM-based Broadcom/Realtek SoCs (commonly found in Tenda devices) involve ROP chains, or they may leverage Ret2Libc or Ret2stack techniques to set up a command shell or execute shell commands directly.

Step 4: Post-Exploitation Impact Once the overflow results in arbitrary code execution, the attacker runs commands with the privileges of the Boa Web Server daemon, which on these embedded routers is typically root. Immediate actions include:

• Creating a backdoor shell binding to a TCP port or connecting outbound to the attacker's C2 server.
• Reading /etc/passwd and configuration files to harvest WPA2 keys for the Wi-Fi network, router admin credentials, or ISP PPPoE credentials.
• Modifying the router's DNS settings to redirect traffic to attacker-controlled resolvers — enabling phishing, credential harvesting, or DNS rebinding attacks.
• Enabling remote access (SSH, telnet) or installing a persistent implant by modifying startup scripts.
• Using the compromised router as a pivot point to attack other devices on the internal network, leveraging ARP spoofing or scanning.

The attack ends with the device fully compromised, silently intercepting or tampering with all traffic traversing the network gateway.

Impact Assessment

Confidentiality Impact: High (C:H) — Successful exploitation provides full read access to the router's file system and configuration. This exposes the WPA2/WPA3 pre-shared key, allowing the attacker to decrypt Wi-Fi traffic at the wireless layer. Additionally, the attacker can read modem credentials (PPP username/password), VPN configurations, and forwarded port settings. Any traffic inspection capabilities on the router enable interception of DNS queries and even HTTP requests, compromising user privacy.

Integrity Impact: High (I:H) — The attacker gains the ability to alter router firmware configurations, modify DNS nameservers, inject malicious JavaScript into HTTP responses (via router-side injection), change firewall rules, and replace legitimate administrative binaries with trojanized versions. Because the device operates at the network gateway, all outbound and inbound traffic can be silently redirected or mutated. An attacker can also flash modified firmware containing permanent implants.

Availability Impact: High (A:H) — The attacker can disable the router's functionality entirely by corrupting configuration, causing repeated reboots via watchdog disruption, or bricking the device by flashing invalid firmware. Even without deliberate disruption, a sloppy exploit attempt can cause a denial-of-service condition via crash of the Boa Web Server process, rendering the management interface unavailable. In the worst-case scenario, the attacker intentionally bricks the device, causing a permanent loss of connectivity for all dependent users.

Affected Systems and Blast Radius: The Tenda HG10 is a home/small-office wireless router. The blast radius extends to all clients connected to the device's wired LAN and Wi-Fi networks. A single compromised router could expose an entire household's or small business's digital footprint, including smart home Internet-of-Things devices, computers, phones, and network-attached storage. Given that no patch source is tracked for this device (patch confidence 0/4), and the product may be end-of-life, the affected population of devices is effectively stuck with the vulnerability indefinitely. The public availability of the exploit further raises the severity, as it substantially lowers the barrier-to-entry for unsophisticated attackers.

Detection Guidance

Sigma Rule

title: Tenda HG10 Boa Web Server Buffer Overflow Attempt
id: c5e2a57f-3c9b-4a6e-8d1b-7f4a1c8e9d22
status: experimental
description: Detects HTTP requests targeting /boaform/formWlanSetup with a suspiciously long ssid parameter, indicative of buffer overflow exploitation against Tenda HG10 routers.
author: Valtersit Threat Intelligence
date: 2026/06/01
logsource:
  category: webserver
  product: apache
  service: access
detection:
  selection:
    cs-uri-path|contains: '/boaform/formWlanSetup'
    cs-uri-query|contains: 'ssid'
  filter_base:
    cs-uri-query|re: '^ssid=[^&]{0,32}(&|$)'
  condition: selection and not filter_base
level: high
falsepositives:
  - Legitimate administrator configuring a very long SSID (unlikely but possible)
tags:
  - attack.initial_access
  - attack.t1190
  - cve.2026.85110

YARA Rule

rule CVE_2026_85110_Tenda_HG10_Boa_Exploit_Payloads
{
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detects exploit payloads targeting CVE-2026-85110 buffer overflow in Tenda HG10 formWlanSetup"
        date = "2026-06-01"
        cve = "CVE-2026-85110"
        severity = "critical"
    strings:
        $endpoint = "/boaform/formWlanSetup" ascii wide nocase
        $ssid_arg = "ssid=" ascii wide nocase
        // Common MIPS shellcode patterns
        $mips_exec = { 28 21 } // slti $at, $at, arbitrary — loose match, indicative of MIPS opcode sequences
        $mips_shell = { 24 0f ff ff 27 bd ff e0 24 0e 73 68 01 c0 20 27 a4 20 01 01 }
        $nop_sled_long = { 24 19 40 69 } // typical NOP equivalent for MIPS
        // String of 'A' padding typical of simple overflow PoCs
        $padding_long = "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA" ascii
    condition:
        uint16(0) == 0x5A4D or filesize < 50KB and any of them
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"CVE-2026-85110 Tenda HG10 formWlanSetup Buffer Overflow Attempt"; flow:established,to_server; http.uri; content:"/boaform/formWlanSetup"; http.client_body; content:"ssid="; distance:0; pcre:"/ssid=[^&\r\n]{60,}/Ui"; classtype:attempted-admin; sid:2026000851; rev:1; reference:cve,2026-85110; metadata:created_at 2026_06_01, updated_at 2026_06_01;)

Elastic Detection

sequence by source.ip with maxspan=5s
  [network where dns.text_query == "external.com" or true] // Placeholder lineage
  [http where http.request.method == "POST" and url.path == "/boaform/formWlanSetup" and
     url.query contains "ssid=" and length(url.query) >= 100]
  [file where event.action == "modification" and process.name == "boa" and (file.extension == "cfg" or file.extension == "conf")]

Note: A more realistic Elastic EQL rule with minimal placeholders:

http where process.name == "boa" and
  url.path == "/boaform/formWlanSetup" and
  (wildcard(url.query, "*ssid=*") or wildcard(http.request.body.content, "*ssid=*")) and
  (length(http.request.body.content) > 100 or length(url.query) > 100)

Splunk SPL Query

index=proxy OR index=web
| search "/boaform/formWlanSetup" AND "ssid="
| eval suspicious = if(len(ssid_param) > 32, "HIGH", "LOW")
| where suspicious == "HIGH"
| eval ssid_param = replace(_raw, "^.*ssid=([^&\r\n]+).*$", "\1")
| where len(ssid_param) > 32
| table _time, src_ip, dest_ip, dest_port, method, uri_path, ssid_param, user_agent
| sort -_time
| limit 100

Alternative simple query:

index=web sourcetype=access_combined
| search uri_path="/boaform/formWlanSetup" AND uri_query="*ssid=*"
| eval ssid_len = len(uri_query)
| where ssid_len > 200
| stats count by src_ip, uri, user_agent

Wazuh OSSEC Rule

<group name="web,attack,exploit,">
  <rule id="100271" level="12">
    <if_sid>31100</if_sid>
    <match>/boaform/formWlanSetup</match>
    <description>Tenda HG10 CVE-2026-85110 Buffer Overflow attempt detected on target</description>
    <group>web_application_attack,buffer_overflow,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
    <var name="alert">yes</var>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Status: UNPATCHED — Patch Confidence 0/4. No evidence of a fix from any tracked source. Tenda has not released any advisory or firmware update to address CVE-2026-85110 for the HG10 (300001138).

Immediate Mitigations:

1. Restrict Management Access: Disable remote/Internet-facing access to the router's web management interface. If remote administration is required, restrict access by trusted source IP via firewall/ACL rules only.
2. Change Default Credentials: Immediately change the router's admin password to a strong, unique passphrase. This is critical, as exploitation requires low privileges (PR:L), and default credentials are often still active.
3. Segment the Network: Place the router management interface on a VLAN separate from user devices, or at minimum disable UPnP and remote management to prevent external exposure.
4. Enable Logging: Enable access and system logs on the router (if available) and forward them to a central SIEM for monitoring of /boaform/formWlanSetup access attempts.

Patch/Upgrade Steps:

1. Check the Tenda official support portal (support.tenda.com.cn or tendacn.com depending on region) for any firmware release notes mentioning security fixes for HG10 (300001138).
2. If a patch becomes available, download the signed firmware and update through the router's web UI. Verify the firmware MD5/SHA checksum against the vendor's published hash.
3. If the HG10 reaches end-of-life with no patch forthcoming, plan for hardware replacement with a vendor that maintains a security advisory program.

Long-Term Hardening:

1. Replace the Tenda HG10 with a router from a vendor with demonstrated security advisory transparency and firmware update cadence (e.g., OpenWrt-compatible devices, or vendors with CVE coordination).
2. If hardware replacement is impossible, install the device strictly behind a dedicated firewall that blocks inbound access to the router's management ports from the WAN.
3. Monitor vendor security bulletins quarterly. Subscribe to CISA Known Exploited Vulnerabilities (KEV) catalog updates — while this CVE is currently NOT in the KEV list, escalated exploitation could prompt its addition, which would mandate federal government action under BOD 22-01.
4. Conduct periodic network scans to inventory all router types on the network and flag any devices with known unpatched CVEs for prioritization.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-85110
2. MITRE CVE Record: https://www.cve.org/CVERecord?id=CVE-2026-85110
3. Tenda Official Website: https://www.tenda.com.cn (search for HG10 firmware and security advisories)
4. CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog (monitor for future inclusion)
5. FIRST EPSS: https://www.first.org/epss/ (when scoring becomes available)

Threat Actor Campaign Evidence: As of this writing, there is no verified public evidence of widespread in-the-wild exploitation campaigns exclusively attributed to CVE-2026-85110, despite the NVD description stating "The exploit is publicly available and might be used." The specific exploit source (public GitHub repository, exploit-db, or other) is not identified in the available data. Organizations running Tenda HG10 devices should treat the device as compromised if it has been exposed to untrusted networks and conduct forensic review of the router configuration and connected client logs.