CVE-2026-1687: Tenda HG10 Boa Webserver formSamba command injection

Published Jan 30, 2026

Updated

A weakness has been identified in Tenda HG10 USHG7HG9HG10re300001138enxpon. Impacted is an unknown function of the file /boaform/formSamba of the component Boa Webserver. Executing a manipulation of the argument serverString can lead to command injection. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks.

Affected Software

4 affected components

Tenda HG10

Boa Webserver

All of the following

Tenda Hg10 Firmware

Tenda HG10

Event History

Jan 30, 2026

CVE Published

via MITRE·04:02 PM

Data Sourced

via MITRE·04:02 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·04:16 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2026-1687?

CVE-2026-1687 has been designated with a medium severity level due to its potential for command injection.

How do I fix CVE-2026-1687?

To fix CVE-2026-1687, update the Tenda HG10 to the latest firmware version that addresses this vulnerability.

What is the impact of CVE-2026-1687?

The impact of CVE-2026-1687 includes unauthenticated command injection through the formSamba function of the Boa Webserver.

Which software is affected by CVE-2026-1687?

CVE-2026-1687 affects Tenda HG10 devices utilizing the Boa Webserver.

Can CVE-2026-1687 be exploited remotely?

Yes, CVE-2026-1687 can be exploited remotely due to vulnerabilities in web server settings.