CVE-2026-6988: Tenda HG10 Boa Service formRouting formRoute buffer overflow

Published Apr 25, 2026

Updated

A flaw has been found in Tenda HG10 HG7HG9HG10re300001138enxpon. This issue affects the function formRoute of the file /boaform/formRouting of the component Boa Service. This manipulation of the argument nextHop causes buffer overflow. It is possible to initiate the attack remotely. The exploit has been published and may be used.

Affected Software

3 affected components

Tenda HG10

All of the following

Tenda Hg10 Firmware=300001138

Tenda HG10

Event History

Apr 25, 2026

CVE Published

via MITRE·05:00 PM

Data Sourced

via MITRE·05:00 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·06:16 PM

DescriptionSeverityWeaknessAffected Software

Apr 15, 58301

Event

via FIRST·01:17 AM

Frequently Asked Questions

What is the severity of CVE-2026-6988?

CVE-2026-6988 has been classified with a high severity due to its potential for remote code execution caused by a buffer overflow.

How do I fix CVE-2026-6988?

To fix CVE-2026-6988, users should update their Tenda HG10 device to the latest firmware version provided by Tenda.

What systems are affected by CVE-2026-6988?

CVE-2026-6988 specifically affects the Tenda HG10 model with the Boa Service running on a vulnerable firmware.

What type of vulnerability is CVE-2026-6988?

CVE-2026-6988 is a buffer overflow vulnerability that can be exploited through improper handling of input in the formRoute function.

Can CVE-2026-6988 allow unauthorized access?

Yes, successful exploitation of CVE-2026-6988 can lead to unauthorized access and potential execution of arbitrary code on the affected device.