CVE-2026-104610 is a stack-based buffer overflow vulnerability in the Boa Web Server's boaGetVar function, specifically in the handling of the Ethtype argument in the /boaform/formLoopBack component on Tenda HG7, HG9, and HG10 devices. This vulnerability allows remote attackers to execute arbitrary code or cause denial of service due to the overflow condition. The vulnerability is remotely exploitable without any privileges or user interaction. The CVSS v3.1 base score is 10.0, indicating critical severity with full confidentiality, integrity, and availability impact. The exploit has been publicly disclosed, increasing the risk of exploitation. No vendor advisory or patch information is currently provided.

Successful exploitation of this vulnerability can lead to complete compromise of the affected device, including remote code execution with full system privileges, resulting in total loss of confidentiality, integrity, and availability. Given the remote, unauthenticated nature of the exploit and the critical severity, affected devices are at high risk of takeover or disruption.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, affected users should consider disabling the vulnerable service or restricting network access to the device's management interface to trusted sources only. Monitor vendor channels for updates and apply patches promptly once released.