CVE-2026-86166: Buffer Overflow in Tenda HG10

CVE-2026-86166 is a buffer overflow vulnerability in the formWanRedirect function of the Boa Web Server component on Tenda HG10 devices. The flaw arises from improper handling of the 'if' argument, allowing remote attackers to execute a buffer overflow attack. This vulnerability has a high CVSS score of 8.8, indicating critical impact on confidentiality, integrity, and availability. Public exploit code has been disclosed, increasing the risk of exploitation. No vendor patch or mitigation details are provided in the available data.

Successful exploitation of this vulnerability can lead to remote code execution or denial of service, severely impacting the confidentiality, integrity, and availability of the affected device. Given the high CVSS score and public exploit disclosure, affected systems are at significant risk if unpatched.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider limiting network exposure of the affected device and monitoring for suspicious activity related to the Boa Web Server. No vendor-provided mitigation or temporary fix is currently documented.