This vulnerability involves a stack-based buffer overflow in the boaGetVar function within the /boaform/formLoopBack file of the Boa Web Server component on Tenda HG7, HG9, and HG10 devices. Manipulating the Ethtype argument can trigger this overflow remotely. The vulnerability has a CVSS 4.0 base score of 10.0, indicating critical severity with network attack vector, low attack complexity, no privileges or user interaction required, and high impacts on confidentiality, integrity, availability, and security requirements. The affected version is 300001138_en_xpon. Public exploit disclosure exists, but no known active exploitation in the wild has been reported.

Successful exploitation of this vulnerability can lead to remote code execution or denial of service due to the stack-based buffer overflow. The critical CVSS score reflects the potential for complete compromise of affected devices without any required privileges or user interaction.

No patch or official remediation information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, affected devices should be isolated from untrusted networks to reduce exposure.