CVE-2026-85110: Tenda HG10 Boa Web Server formWlanSetup buffer overflow
Published Sep 3, 2026
·Updated
A vulnerability was identified in Tenda HG10 300001138. Impacted is the function formWlanSetup of the file /boaform/formWlanSetup of the component Boa Web Server. The manipulation of the argument ssid leads to buffer overflow. Remote exploitation of the attack is possible. The exploit is publicly available and might be used.
Affected Software
2 affected components
Tenda HG10=300001138
Boa Web Server
Event History
Sep 3, 2026
CVE Published
via MITRE·01:45 PM
Data Sourced
via MITRE·01:45 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What access does an attacker need to exploit this issue?
The issue is remotely exploitable over the network and requires low privileges. No user interaction is required.
2
Which input should defenders focus on when assessing exposure?
The vulnerable handler is /boaform/formWlanSetup, and the affected argument is ssid. Systems exposing this Boa Web Server functionality should be treated as potentially affected.
3
Is exploit code available?
Yes. A public exploit is available, which increases the likelihood that the flaw could be used in attacks.