Tenda HG7/HG9/HG10: Stack-based buffer overflow in Boa web server formLoopBack
Summary
Tenda HG7, HG9 and HG10 fibre (xPON) terminals running firmware 300001138_en_xpon contain a stack-based buffer overflow in the Boa web server. The overflow is triggered by an overlong Ethtype parameter sent to /boaform/formLoopBack. A remote attacker may be able to crash the management service or execute code on the device, and a public exploit has been disclosed. The CVSS 4.0 score is 9.3, while the NVD entry is deferred and the conflicting sources disagree on the privileges required.
Affected
- Tenda HG7, HG9 and HG10 with firmware 300001138_en_xpon
- Component: Boa web server, function boaGetVar, endpoint /boaform/formLoopBack
Fixed in
Unknown.
- Firmware 300002266 (2026-05-27) is listed for HG7/HG9/HG10 but is not confirmed to fix this issue.
Workaround
- Block remote access to the web management interface on the WAN side and restrict it to a trusted management network.
- Block or restrict external requests to /boaform/formLoopBack at the firewall.
Exploitation
- The CVE record states that a public exploit has been disclosed and may be used.
- CISA SSVC: exploitation status PoC, automatable yes, technical impact total.
- Not recorded in the CISA KEV catalog at the time of research.
- In-the-wild exploitation: Unknown.
Our recommendation
- Identify all Tenda HG7, HG9 and HG10 devices, including those supplied by ISPs.
- Remove WAN exposure of the web admin interface and restrict it to trusted networks.
- Ask the ISP or Tenda whether a firmware fix is available and apply it once confirmed.
- Monitor device logs for requests to /boaform/formLoopBack and replace devices if no fix is available.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- VulDB CVE entry vuldb.com
- VulDB vulnerability entry vuldb.com
- GitHub issue describing the vulnerability github.com
- Tenda HG9 firmware download page www.tendacn.com
- Tenda vendor website www.tenda.com.cn
- PSIRT CVE entry psirt.com
- OpenCVE entry app.opencve.io
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 03:36.
Original description (NVD)
A security vulnerability has been detected in Tenda HG7, HG9 and HG10 300001138_en_xpon. This impacts the function boaGetVar of the file /boaform/formLoopBack of the component Boa Web Server. Such manipulation of the argument Ethtype leads to stack-based buffer overflow. The attack can be executed remotely. The exploit has been disclosed publicly and may be used.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.