Stack-Based Buffer Overflow in Tenda HG Series
CVE-2026-104610

10CRITICAL

Key Information:

Vendor: Tenda
Status: Hg7; Hg9; Hg10
Vendor: CVE Published:; 2 October 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-104610?

A critical security vulnerability exists in Tenda's HG7, HG9, and HG10 routers, specifically within the function boaGetVar of the Boa Web Server component. This vulnerability allows an attacker to manipulate the Ethtype argument, resulting in a stack-based buffer overflow. The nature of this vulnerability permits remote exploitation, making it imperative for users to take immediate action to secure their devices. Public disclosure of the exploit details heightens the urgency, as attackers can potentially leverage this weakness to compromise affected systems.

Affected Version(s)

HG10 300001138_en_xpon

HG7 300001138_en_xpon

HG9 300001138_en_xpon

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-104610 - Proof of Concept