CVE-2026-86167

Executive Summary

CVE-2026-86167 is a critical OS command injection vulnerability in the Tenda HG10 router (firmware build 300001138), affecting the formgponConf function within the Boa HTTP web server component. An authenticated remote attacker can inject arbitrary operating system commands by manipulating the fmgpon_loid argument, achieving full system compromise with high-impact consequences to confidentiality, integrity, and availability. The vulnerability carries a CVSS score of 9.9, is publicly known with exploit code available, and remains unpatched with no vendor remediation identified at the time of writing.

Technical Analysis

The vulnerability resides in the Tenda HG10 gigabit home gateway device, specifically within the firmware build identified as 300001138. The affected component is Boa — a lightweight open-source HTTP web server historically used in many embedded networking devices due to its minimal resource footprint. Boa handles the administrative web interface and processes configuration requests on the device.

The vulnerable endpoint is /boaform/admin/formgponConf, which corresponds to the formgponConf function in the Boa CGI (Common Gateway Interface) handler implementation. This endpoint is responsible for processing GPON (Gigabit Passive Optical Network) configuration parameters — specifically the LOID (Logical ONU ID), which is used for service provisioning authentication in fiber-optic broadband deployments.

The flaw manifests as an OS command injection (CWE-77) via the fmgpon_loid argument. The application appears to pass the user-supplied value of this parameter directly to a system-level command or shell invocation without adequate sanitization, input validation, or parameterization. An attacker who can supply a crafted value containing shell metacharacters (e.g., ;, |, &&, backticks, or $(...)) can terminate the intended command and execute arbitrary instructions in the device's operating system context.

The vulnerability is classified under CWE-77 (Improper Neutralization of Special Elements used in a Command), indicating that user input flows into a command that is executed by the operating system.

Key technical details:

• Attack Vector: Network (remote), requiring low-privilege authentication (PR:L in the CVSS vector)
• Attack Complexity: Low — no unusual conditions are required
• User Interaction: None required
• Scope: Changed (C) — the compromise extends beyond the vulnerable component, as a foothold in the router's operating system can impact all network traffic traversing the device
• Affected Component: Boa HTTP server → formgponConf function
• Affected File: /boaform/admin/formgponConf
• Affected Argument: fmgpon_loid

The audit report indicates that the exploit is publicly available and may be used — this suggests proof-of-concept code has been released, lowering the barrier for opportunistic attackers. The lack of a disclosed patch, vendor advisory, or CISA KEV listing increases the residual risk window.

It should be noted that the NVD description is sparse on implementation specifics such as how the shell command is constructed or which underlying binaries are invoked (e.g., gpon_conf.sh or similar). Insufficient technical detail is available on the exact command construction methodology. That said, the vulnerability class is unambiguous: unvalidated input to a command execution sink leads to remote code execution.

Exploitation Scenarios

Based on the NVD description and vulnerability class, the following attack chain is plausible:

Step 1 — Reconnaissance and Target Identification: An attacker first identifies Tenda HG10 devices with the vulnerable firmware build (300001138) exposed to the network. This can be performed via Internet-wide scanning (e.g., Shodan, Censys) for devices responding on the Boa web server's administrative port (typically TCP 80 or 8080, although the exact port was not disclosed in the vulnerability description — insufficient technical detail available). Alternatively, an attacker with LAN access can directly target the device's gateway IP address. The attacker must obtain valid low-privilege credentials, which often default to trivial values (e.g., admin/admin) on consumer/SMB-grade networking gear or may be harvested via phishing, credential stuffing, or brute force.

Step 2 — Authentication and Request Formulation: The attacker authenticates to the Boa administrative interface and crafts an HTTP POST (or GET, depending on Boa's configuration) request to the endpoint /boaform/admin/formgponConf, supplying a malicious value for the fmgpon_loid parameter.

Step 3 — Injection Payload Execution: Because the fmgpon_loid value is passed directly into an OS-level shell command without sanitization, the attacker appends shell metacharacters and an arbitrary command to the legitimate command. For example, at a blind class level, input such as AAAA; <arbitrary_command> would terminate the intended command and execute the attacker-controlled payload. The subsequent command runs with the privileges of the Boa process — on embedded devices, this is typically the root user or a high-privilege system account.

Step 4 — Post-Exploitation Impact: Upon successful command injection, the attacker has full remote code execution on the router. This enables a broad range of malicious activities:

• Persistence: Writing a web-shell backdoor, modifying cron jobs, or adding an SSH dropbear/Dropbear daemon instance for future access
• Network Pivoting: Using the compromised router as a pivot point into the trusted internal LAN, intercepting or manipulating traffic (DNS hijacking, ARP spoofing, traffic redirection through a proxy)
• Credential Theft: Reading device configuration (including ISP credentials, WiFi PSK, and PPPoE credentials), sniffing LAN traffic, or harvesting session tokens of other administrative users
• Denial of Service: Flashing corrupted firmware, deleting critical system files, or taking the device offline entirely
• Botnet Recruitment: Involving the device in DDoS botnets (Mirai-style) given its always-on, network-connected nature

It is important to note that while the NVD description terms the authentication requirement "low privilege" (PR:L in the CVSS vector), on most consumer-grade routers, administrative access to the Boa interface is equivalent to full administrative control. No public PoC was provided in the data; the attack chain is inferred from the vulnerability class and prior public disclosures of this type.

Impact Assessment

CVE-2026-86167 represents a severe security risk due to a combination of factors:

CVSS Analysis (Score 9.9 — Critical):

• Attack Vector (AV:N): Remotely exploitable over the network
• Attack Complexity (AC:L): No special conditions are required
• Privileges Required (PR:L): Only low-level authentication is needed
• User Interaction (UI:N): No user action is required
• Scope (S:C): The compromise of the router's OS impacts resources beyond the vulnerable Boa component, including all connected LAN clients and their traffic
• Confidentiality/Integrity/Availability (C:H/I:H/A:H): Complete loss of all three security properties

Business Impact: The Tenda HG10 is a home/small-office fiber gateway. A successful attacker obtains full control of the primary network egress point of the subscriber premises. This permits:

• Data Exfiltration: Monitoring all inbound/outbound traffic, including plaintext credentials, banking sessions, and corporate VPN traffic (if teleworkers use the home network)
• Lateral Movement: Once the gateway is compromised, the attacker can reach any device on the internal LAN segment, including IoT devices, personal computers, and network storage
• E-Crime Infrastructure: Subverting the router to redirect traffic for phishing lures, drive-by downloads, or cryptomining (given the limited compute resources, DDoS participation is the most realistic outcome)
• Telecom Infrastructure Abuse: GPON networks are often managed via OMCI/TR-069; a compromised ONT/ONU could be leveraged to attack the ISP's management plane, though the feasibility of this escalation depends on ISP network segmentation and is not part of the vulnerability's scope

Affected Systems: Devices running Tenda HG10 firmware build 300001138. The exact version range is broader likely (other firmware builds may share the same vulnerable code path); the vendor's patch confidence is 0/4, indicating no known patched version has been released.

Blast Radius: The direct and indirect compromise of an internet-facing CPE device can expose sensitive data of all household users and can provide a stepping stone to other organizational assets when employees work from home. Given the always-on nature of fiber gateways and typically poor patching behavior of CPE firmware, the window of exposure is expected to be prolonged.

Exploit Status: Public exploit availability increases urgency; in the absence of a vendor patch, organizations should expect active exploitation attempts, particularly from botnets and opportunistic scanners.

Detection Guidance

Detection of exploitation attempts centers on identifying anomalous access to the Boa administrative interface, unusual command execution patterns on the device (if log monitoring capability exists), and anomalous outbound traffic from the device.

Sigma Rule

title: Tenda HG10 FormGponConf OS Command Injection Attempt
id: 7e3c9ab2-3d5a-4f0c-9c2b-8e5a1d4b0c21
status: experimental
description: Detects HTTP requests to the Tenda HG10 formgponConf endpoint containing shell metacharacters indicative of OS command injection via the fmgpon_loid parameter.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-86167
author: Valters IT Security Team
date: 2026/02/14
logsource:
    category: webserver
    product: generic
detection:
    selection_path:
        cs-uri-path|contains: '/boaform/admin/formgponConf'
    selection_method:
        cs-method: 'POST'
    selection_injection_patterns:
        cs-uri-query|contains:
            - 'fmgpon_loid='
        cs-uri-query|contains|any:
            - ';'
            - '|'
            - '&&'
            - '`'
            - '$(('
            - '%24%28'
            - '%3B'
            - '%7C'
    condition: selection_path and selection_method and selection_injection_patterns
falsepositives:
    - Legitimate GPON configuration parameter values containing special characters (rare; LOID values are typically alphanumeric)
level: high

YARA Rule

rule CVE_2026_86167_Tenda_HG10_FormGponConf_Command_Injection
{
    meta:
        author = "Valters IT Security Team"
        description = "Detects payload patterns targeting the fmgpon_loid parameter in Tenda HG10 formgponConf endpoint"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-86167"
        date = "2026-02-14"
        cve = "CVE-2026-86167"
        score = 80
    strings:
        $endpoint_a = "/boaform/admin/formgponConf" ascii wide
        $endpoint_b = "formgponConf" ascii wide
        $arg_loid = "fmgpon_loid" ascii wide
        $cmd_exec1 = "cmd=" ascii wide
        $cmd_exec2 = ";/" ascii wide
        $cmd_exec3 = "|/" ascii wide
        $cmd_exec4 = "&&" ascii wide
        $cmd_exec5 = "$(" ascii wide
        $cmd_exec6 = "`" ascii wide
        $cmd_exec7 = "wget" ascii wide
        $cmd_exec8 = "curl" ascii wide
        $cmd_exec9 = "nc -e" ascii wide
        $cmd_exec10 = "wget -q -O" ascii wide
    condition:
        uint16(0) == 0x4D5A or filesize < 10MB
        and any of ($endpoint_*) and any of ($arg_*)
        and 2 of ($cmd_exec*)
}

Note: The YARA rule is intended for inspecting log files, PCAP text exports, or web proxy logs captured from traffic targeting vulnerable Tenda devices. It is not suitable for scanning binary firmware alone.

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-86167 Tenda HG10 formgponConf OS Command Injection Attempt"; flow:established,to_server; content:"/boaform/admin/formgponConf"; http.uri; nocase; content:"fmgpon_loid"; http.uri; nocase; pcre:"/(?:%3B|%7C|%26%26|%60|\x3b|\x7c|\x26\x26|\x60|\$\(|`|\|)/i"; classtype:attempted-admin; reference:cve,2026-86167; reference:url,https://nvd.nist.gov/vuln/detail/CVE-2026-86167; sid:2026861; rev:1;)

Rationale: The rule triggers when an HTTP request URI contains both the vulnerable endpoint path and the fmgpon_loid parameter, followed by a shell metacharacter pattern via Perl-compatible regex. Both URL-encoded (%3B, %7C, %26%26, %60) and raw metacharacters are matched to account for variations in encoder usage.

Elastic Detection

sequence with maxspan=5s
  [ network where event.type == "start" and
      destination.port in (80, 8080, 443) and
      url.path == "/boaform/admin/formgponConf" and
      url.query contains "fmgpon_loid=" ]
  [ network where event.type == "end" and
      source.port in (80, 8080, 443) and
      network.protocol == "http" and
      http.response.status_code == 200 ]

Note: The EQL sequence above tracks successful HTTP request/response pairs to the vulnerable endpoint. To increase signal strength, security analysts should enrich this with a correlation that inspects the URL query string for shell metacharacters. A more targeted EQL alternative:

any where process.name == "*" and
  event.module == "system" and
  // Identify anomalous child processes spawned post-request
  // This EQL assumes device-level logging (e.g., syslog forwarding from the router)
  process.parent.name in ("boa") and
  process.command_line contains (
    ";", "|", "&&", "$(", "`", "wget", "curl", "/bin/sh"
  )

Caution: The second EQL above relies on the assumption that logging/agent visibility exists on the embedded device itself, which is uncommon for consumer-grade hardware. In the majority of deployment scenarios, the network-level sequence is the realistic detection path.

Splunk SPL Query

index=proxy OR index=web OR index=firewall
| where like(uri_path, "%/boaform/admin/formgponConf%")
| where like(uri_query, "%fmgpon_loid=%")
| regex uri_query="(?i)(%3B|%7C|%26%26|%60|\x3b|\x7c|\x26\x26|\x60|\$\(|`|\|)"
| stats count by src_ip, dest_ip, uri, http_method, _time
| sort - _time
| table _time, src_ip, dest_ip, http_method, uri, count

Query explanation: The query searches proxy, web, and firewall logs for requests to the GPON configuration endpoint containing the fmgpon_loid parameter. It then applies a regular expression filter to identify requests containing shell metacharacters (raw or URL-encoded), and aggregates results by source/destination for triage. Analysts should also run a companion query watching for outbound traffic from the router to unknown IPs on ports 80, 443, 53, or 6667 (IRC), which may indicate a callback or botnet behavior post-exploitation.

Wazuh OSSEC Rule

<group name="tenda, cve-2026-86167,">
    <rule id="100861" level="15">
        <decoded_as>web-log</decoded_as>
        <field name="url">/boaform/admin/formgponConf</field>
        <regex>fmgpon_loid=.*(%3B|%7C|%26%26|%60|;|\||&amp;&amp;|`|\$\(.</regex>
        <description>Tenda HG10 formgponConf OS Command Injection Attempt (CVE-2026-86167)</description>
        <group>webserver_attack,attempted_admin,command_injection,</group>
        <mitre>
            <id>T1190</id>
        </mitre>
        <info type="cve">CVE-2026-86167</info>
    </rule>
</group>

Deployment note: Wazuh agents must be positioned to monitor web server access logs (e.g., using localfile output pointing at Boa access log files if the router forwards logs via syslog, or a reverse proxy in front of the router). Alternatively, the rule can be adapted to parse syslog entries from the router itself if system log forwarding is enabled.

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED. No patch evidence exists from any tracked source. No vendor advisory or fixed firmware build has been disclosed. The vendor has not engaged in the coordination process for this vulnerability.

1. Immediate Mitigations

• Restrict Administrative Access: Disable remote admin access to the Boa web interface (usually via the device's "Remote Management" setting). Force all administrative access to be LAN-only.
• Network Segmentation: Place the router's administration port behind a firewall and restrict source IPs to trusted management hosts. Block external access to ports 80, 443, 8080, and 8443 on the WAN side.
• Change Default Credentials: Immediately change all default passwords, including the administrative web login and any telnet/SSH credentials. Use strong, unique passwords.
• Disable Unnecessary Services: Turn off any services not required for the router's function (e.g., telnet, SNMP if not used, UPnP, and remote diagnostics).
• Apply Workaround Where Possible: If the specific firmware supports it, restrict GPON configuration changes via access control lists or rate-limit requests to /boaform/admin/formgponConf.

2. Patch/Upgrade Steps

• Check for Vendor Updates: Monitor Tenda's official support page and firmware release notes. Firmware updates should be installed immediately upon availability of a version later than 300001138 that explicitly addresses CVE-2026-86167.
• Contact ISP: Since the HG10 is a GPON CPE distributed and managed by internet service providers, the ISP is the primary patching channel. Reach out to your ISP to request a firmware update timeline and inquire whether the device can be remotely patched via TR-069.
• Device Replacement: If no patch is forthcoming within a reasonable time frame, consider replacing the device with hardware from a vendor with a demonstrated patch cadence, or placing the device in bridge mode behind a secure firewall/router.

3. Long-Term Hardening

• Treat CPE as Untrusted: Place the device in a DMZ-only role if possible. Use a separate enterprise-grade firewall/router for actual security functions; treat the CPE strictly as a modem/bridge.
• Continuous Monitoring: Enable and forward syslog data from the router (if supported) to a central SIEM. Monitor for anomalous access to the Boa admin interface.
• Vendor Due Diligence: When procuring network equipment, prioritize vendors with published vulnerability disclosure policies and show a track record of timely firmware security patches.
• Incident Readiness: Given the public availability of the exploit and the lack of patch, plan for the possibility of a compromise. Take routine configuration backups and maintain network segmentation so that even a full device compromise has limited blast radius to corporate assets.

References

1. NVD Entry — https://nvd.nist.gov/vuln/detail/CVE-2026-86167 (NVD Description and CVSS scoring details)
2. CWE-77 — Command Injection — https://cwe.mitre.org/data/definitions/77.html (Weakness classification)
3. MITRE ATT&CK — T1190 Exploit Public-Facing Application — https://attack.mitre.org/techniques/T1190/ (Technique mapping)
4. FIRST EPSS — https://www.first.org/epss/ (For ongoing EPSS score tracking; not yet scored at time of writing)
5. CISA KEV Catalog — https://www.cisa.gov/known-exploited-vulnerabilities-catalog (Not yet listed as of report date; monitor for addition)

Threat Actor Campaigns / Exploit-in-the-Wild Evidence: The CNA/NVD reporting notes that the exploit is publicly available and may be used; however, no evidence of a specific named threat actor campaign, botnet integration, or widespread exploitation has been documented in the reviewed sources as of the report date. The absence of an EPSS score and CISA KEV listing suggests that metric-driven reporting is still pending and the vulnerability may be recent. Organizations should treat the public exploit availability as a clear and present danger given the criticality score of 9.9.