A vulnerability was identified in Tenda HG10 300001138. (CVE-2026-86167)

CVE-2026-86167 is an OS command injection vulnerability in the Tenda HG10 300001138 device affecting the formgponConf function within the /boaform/admin/formgponConf component of the Boa web server. The vulnerability arises from improper input validation of the fmgpon_loid argument, enabling remote attackers with low privileges to execute arbitrary OS commands. The vulnerability has a CVSS 3.1 score of 9.9, indicating critical impact on confidentiality, integrity, and availability. Public exploit code exists, increasing the risk of exploitation. No patch or official remediation information is currently available.

Successful exploitation allows remote attackers with low privileges to execute arbitrary operating system commands on the affected device, potentially leading to full compromise of confidentiality, integrity, and availability of the system. This can result in unauthorized control, data theft, or disruption of device functionality.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected device's administrative interfaces to trusted networks and users only. Monitor for any updates from the vendor regarding patches or mitigations.