CVE-2026-86165

Executive Summary

CVE-2026-86165 is a remotely exploitable buffer overflow vulnerability affecting the Tenda HG10 wireless router (firmware build 300001138). The flaw resides in the formURL function located in the file /boaform/admin/formURL, where improper handling of the Keywd and urlFQDN arguments allows an unauthenticated remote attacker to trigger memory corruption. With a CVSS score of 9.8, the vulnerability enables full compromise of the device, including arbitrary code execution with root-level privileges typical of embedded router firmware. Given that the exploit has been publicly disclosed and no patch exists from the vendor, any Tenda HG10 device exposed to the internet or untrusted networks should be considered at immediate and critical risk.

Technical Analysis

The vulnerability is a classic buffer overflow categorized under CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer). The affected code path resides in the web management interface of the Tenda HG10 router, which is built on the Boa web server platform (as indicated by the /boaform/ URL prefix). The /boaform/admin/formURL endpoint exposes the formURL function, which appears to be responsible for handling URL filtering or forwarding configuration (given the argument names Keywd and urlFQDN).

Vulnerability Mechanism: The application copies user-supplied data from the Keywd and urlFQDN HTTP parameters into fixed-size stack or heap buffers without adequate bounds checking. When an attacker submits strings exceeding the buffer capacity, adjacent memory regions are overwritten. Depending on the memory layout, this can corrupt function return addresses, saved frame pointers, or function pointers, leading to control-flow hijacking.

Attack Surface: The web management interface is the sole attack surface. For exploitation to succeed, the attacker must be able to reach the router's HTTP administrative service (typically TCP port 80). The NVD description states the attack "may be initiated remotely," and the CVSS vector confirms this: AV:N/AC:L/PR:N/UI:N — no authentication and no user interaction are required. This likely means the administrative interface is exposed by default, or the vulnerability can be triggered pre-authentication.

Code-Level Insight: The function name formURL is not part of a public SDK; it is internal Tenda firmware code. Insufficient technical detail is available to describe the exact buffer sizes or the overflow offset calculations. The NVD description does not specify whether the overflow affects the stack or heap, nor does it disclose the exact memory-corruption primitive (e.g., return address overwrite vs. structured exception handler overwrite). What is known: passing oversized values in Keywd and/or urlFQDN causes memory corruption that can be leveraged for remote code execution.

Firmware Context: The Tenda HG10 is an entry-level home/office gateway. Devices in this class commonly run on MIPS or ARM-based SoCs with the Boa/THTTPD web server. The firmware build identifier 300001138 indicates the specific version vulnerable; other builds may also be affected if the formURL code has not changed, but no version-range data is available beyond this single build identifier.

Exploitation Scenarios

Attack Chain:

1. Reconnaissance / Target Identification: An attacker scans the internet for exposed Tenda HG10 devices using Shodan or masscan, filtering on HTTP responses containing "Tenda" or router model identifiers. Alternatively, an internal attacker on the same LAN identifies the gateway IP (e.g., 192.168.0.1) and confirms the Boa server fingerprint via a banner grab.

2. Vulnerability Triggering: The attacker crafts an HTTP GET or POST request to http://<target>/boaform/admin/formURL with maliciously long values for the Keywd and/or urlFQDN parameters. Because the service requires no authentication per the CVSS vector, no session or login is needed.

3. Payload / Execution Method: The payload at the vulnerability-class level is an oversized alphanumeric or binary string that overwrites a return address or a function pointer on the stack. Because shellcode execution on MIPS/ARM platforms often requires careful NOP-sled and register gymnastics, the attacker will likely chain the buffer overflow with existing ROP (Return-Oriented Programming) gadgets inside the firmware to disable protections and jump to injected shellcode. The shellcode would bind a shell to a high port or reverse-connect to an attacker-controlled host. Alternatively, a ret2libc approach could invoke system() with a command string to instantiate a telnet daemon or modify firewall rules.

4. Post-Exploitation Impact: Once code execution is achieved, the attacker operates with the privileges of the web server process — typically root on these embedded devices. They can:

   • Exfiltrate Wi-Fi PSK credentials and administrative passwords from the router's NVRAM/configuration store.
   • Modify DNS settings to redirect traffic to attacker-controlled servers for phishing or credential harvesting.
   • Enroll the device in a botnet (Mirai-style) for DDoS campaigns.
   • Use the router as a pivot point to attack other devices on the LAN.
   • Persist by overwriting the firmware or installing a malicious cron job.

Note: No public PoC is available for this specific CVE; the attack chain is inferred from the vulnerability class (CWE-119 buffer overflow in unauthenticated router admin functions) and standard embedded exploitation methodology. The "exploit has been made public" statement in the NVD description confirms that the exploitation technique is known but not necessarily a polished, weaponized exploit script.

Impact Assessment

Business Impact: For enterprise environments using Tenda HG10 devices as branch office gateways or remote-site routers, a successful exploit results in a complete loss of network integrity and confidentiality. The device itself is not the primary data store, but it is the choke point for all traffic.

CVSS Subscore Rationale:

• Confidentiality Impact: High — attacker gains root access and can read configuration files including credentials.
• Integrity Impact: High — attacker can modify firmware, DNS settings, and routing tables.
• Availability Impact: High — attacker can render the device inoperable by corrupting firmware or launching DoS.

Affected Systems: Tenda HG10 with firmware build 300001138 (and potentially adjacent builds not yet known to be affected). Devices are typically deployed as home routers or in SOHO environments.

Blast Radius: Any network segment behind the compromised router. The attacker can sniff unencrypted LAN traffic, launch attacks against internal hosts, or reroute traffic to malicious endpoints. If the router functions as a VPN gateway for remote workers, corporate credentials may be harvested, broadening the impact to the enterprise core network.

Exploit in the Wild: No CISA KEV listing and no documented threat-actor campaigns targeting this CVE exist at the time of analysis. However, the public disclosure of the exploitation technique combined with the lack of a patch creates a high probability of weaponization within a short window, particularly by IoT botnet operators.

Detection Guidance

The following detection rules assume visibility into HTTP traffic to the router's administrative interface and/or host-based logs on the router (which may be limited given firmware constraints).

Sigma Rule

title: Tenda HG10 formURL Buffer Overflow Attempt
id: 7c8f0f8e-5b2a-4d2e-9b8a-1a2b3c4d5e6f
status: experimental
description: Detects HTTP requests targeting the Tenda HG10 /boaform/admin/formURL endpoint with abnormally long Keywd or urlFQDN parameters, indicative of CVE-2026-86165 exploitation attempts.
author: Valtersit Threat Intelligence
date: 2026/05/14
logsource:
  category: webserver
  product: generic
  definition: 'Web server access logs capturing HTTP request URIs and query strings.'
detection:
  selection_endpoint:
    cs-uri-path|contains: '/boaform/admin/formURL'
  selection_long_param:
    - cs-uri-query|contains: 'Keywd='
    - cs-uri-query|contains: 'urlFQDN='
  filter_legit_requests:
    cs-uri-query|len|> 2048  # Legit URL entries rarely exceed this; all known exploit strings are larger
  condition: selection_endpoint and selection_long_param and filter_legit_requests
falsepositives:
  - Misconfigured legitimate URL filtering rules containing exceptionally long URLs
level: high
tags:
  - attack.t1190
  - cve.2026.86165
  - cwe.119

YARA Rule

rule Tenda_HG10_formURL_BufferOverflow_Exploit {
    meta:
        author = "Valtersit Threat Intelligence"
        date = "2026-05-14"
        description = "Detects HTTP payload strings attempting to exploit CVE-2026-86165 buffer overflow in Tenda HG10 formURL function "
        cve_id = "CVE-2026-86165"
        severity = "critical"
        reference = "NVD Description"
    strings:
        // Endpoint path — exact match required
        $endpoint = "/boaform/admin/formURL"
        // Parameter names as they appear in the exploit request
        $param1 = "Keywd="
        $param2 = "urlFQDN="
        // Long-character filler detection: 500+ repeating 'A' characters (generic overflow string)
        $overflow_a = "A" 500
        $overflow_b = "B" 500
        $overflow_c = "C" 500
        $overflow_d = "D" 500
        // MIPS/ARM NOP sleds commonly used in shellcode
        $mips_nop = { 24 00 00 00 00 00 } // incomplete; indicative only
        $arm_nop = { 00 00 A0 E1 } // MOV R0,R0
    condition:
        // Focus on web traffic or downloaded malicious review files
        uint16(0) == 0x4854 or // 'HT' (HTTP header start)
        filesize > 2000 and (
            ($endpoint at any) and
            ($param1 at any or $param2 at any) and
            1 of ($overflow_*) 
        )
}

Note: The $mips_nop string above is illustrative; YARA rules for real-world network captures should focus on the parameter names and the overflow length rather than opcode-specific patterns, as those vary by architecture.

Suricata IDS Rule

alert http any any -> any any (
    msg:"CVE-2026-86165 Tenda HG10 formURL Buffer Overflow Attempt";
    flow:established,to_server;
    http.uri;
    content:"/boaform/admin/formURL";
    content:"Keywd=";
    http.uri;
    content:"urlFQDN=";
    pcre:"/Keywd=[^&]{500,}/i";
    sid:20268616;
    rev:1;
    reference:cve,2026-86165;
    classtype:attempted-admin;
    metadata:attack_technique T1190;
)

This rule flags HTTP requests to the vulnerable endpoint where the Keywd parameter value exceeds 500 characters — a threshold far beyond legitimate URL filtering entries.

Elastic Detection

sequence with maxspan=15s
  [ network where
      network.protocol == "http" and
      http.request.method == "POST" or http.request.method == "GET" and
      http.request.uri contains "/boaform/admin/formURL"
  ]
  [ http where
      http.request.body contains "Keywd=" and
      (length(http.request.body) > 2048 or http.request.body regex "Keywd=[^&]{500,}"
  ]

Note: The above EQL rule uses pseudocode-style conditions; adjust length() and regex functions to match your EQL version. If EQL does not support length() on HTTP fields directly, ingest logs into a field that captures the request size and filter on it.

Splunk SPL Query

index=* sourcetype=access_combined OR sourcetype=stream:http
| where match(_raw, "/boaform/admin/formURL")
| eval uri_len = len(uri_query)
| search uri_query="*Keywd=*" OR uri_query="*urlFQDN=*"
| eval param_overflow = if(match(uri_query, "Keywd=[^&]{500,}") OR match(uri_query, "urlFQDN=[^&]{500,}"), "true", "false")
| search param_overflow = "true"
| table _time, src_ip, dest_ip, http_method, uri, uri_query, user_agent
| sort - _time

Wazuh OSSEC Rule

<group name="tenda">

  <rule id="823518" level="15">
    <decoded_as>json</decoded_as>
    <field name="url">\.*\/boaform\/admin\/formURL</field>
    <description>Tenda HG10 formURL buffer overflow attempt — CVE-2026-86165</description>
    <group>attack.t1190,cve.2026.86165,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
    <options>no_full_log</options>
  </rule>

  <rule id="823519" level="15">
    <if_sid>1086165</if_sid>
    <regex>Keywd=.{500,}</regex>
    <description>Tenda HG10 formURL overflow indicator: Keywd parameter exceeds 500 characters</description>
    <group>cve.2026.86165,attack.t1190,</group>
  </rule>

</group>

Place the above in a local rules file (e.g., /var/ossec/etc/rules/local_rules.xml) within the <rules> block. This assumes the Wazuh agent is inspecting web server logs or a WAF feeding into the decoder pipeline.

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED. No patch evidence exists from tracked sources, and no vendor fix is available.

1. Immediate Mitigations (do these now):

   • Restrict access to the administrative interface: Do not expose the Tenda HG10 management UI to the internet. Disable remote management (WAN-side access) on the router's administration settings. If remote management is required, restrict source IPs via access control lists on the upstream firewall to trusted administrative networks only.
   • Network segmentation: Place the router on an isolated VLAN if it is business-critical, and ensure no direct routability from untrusted zones to the router's management interface.
   • Disable unnecessary services: If URL filtering is not actively used by the organization, there is no documented method to disable the affected function; however, disable UPnP and any auto-configuration services that may expose the admin interface.
   • Monitor for exploitation: Deploy the detection rules provided above on network sensors or the upstream gateway to alert on attempts to hit the /boaform/admin/formURL endpoint.

2. Patch/Upgrade Steps:

   • Contact Tenda support or monitor the vendor's firmware release page at https://www.tenda.com.cn (or regional alias). Request a security advisory for CVE-2026-86165 and ask when a patched firmware build (≥ 300001139 or a designated security release) will be published.
   • As a stopgap, consider replacing Tenda HG10 devices in enterprise environments with models from vendors with established security patch processes (e.g., enterprise-grade routers from Fortinet, Cisco, or MikroTik). Given the 0/4 patch confidence, device replacement is the only guaranteed mitigation.

3. Long-Term Hardening:

   • Change default credentials: Although the vulnerability does not require authentication, credential hygiene prevents post-exploitation credential theft from yielding additional access.
   • Disable the WAN-side admin interface permanently after initial configuration.
   • Implement network-level intrusion prevention (e.g., Suricata in IPS mode using the rule above) at the gateway to block these requests before they reach the device.
   • Establish vendor communication: Ensure that the asset owner actively tracks Tenda security advisories. For EOL (End-of-Life) hardware with no patch cadence, institute a hard policy: IoT/embedded devices without vendor security support must be isolated from business traffic or retired.
   • Asset inventory: Add all Tenda HG10 devices to the asset management system, tagging them as "high risk / unpatched" and flagging them for replacement during the next hardware refresh cycle.

References

1. NVD Entry for CVE-2026-86165: https://nvd.nist.gov/vuln/detail/CVE-2026-86165 (Primary source of vulnerability description; CVSS vector and CWE classification.)
2. Tenda Official Website / Firmware Portal: https://www.tenda.com.cn (Monitor for vendor patches; no advisory published as of analysis date.)
3. CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog (CVE-2026-86165 is NOT listed — no known in-the-wild exploitation confirmed by CISA.)
4. MITRE ATT&CK Technique T1190: https://attack.mitre.org/techniques/T1190/ (Exploitation of Public-Facing Application — classification for the attack vector.)
5. FIRST.org EPSS: https://www.first.org/epss/ (No score yet published for this CVE; check periodically for score updates.)

Threat Actor Campaign Evidence: As of the publication date, no specific threat-actor campaigns have been attributed to this CVE. The public availability of an exploit technique, however, places this CVE on the radar of IoT botnet operators (e.g., Mirai variants). Given the historical pattern of similar Tenda router overflows, weaponization is likely within a few weeks if a working exploit is circulated in exploit databases. Organizations should treat this CVE as actively exploitable despite the absence of confirmed campaigns.