CVE-2026-11498 is a stack-based buffer overflow vulnerability affecting Tenda HG7HG9 and HG10 devices running firmware version 300001138_en_xpon. The issue resides in the asp_voip_OtherSet function of the /boaform/voip_other_set Web Management Interface component. By remotely manipulating the funckey_transfer argument, an attacker can cause a stack-based buffer overflow, which may lead to arbitrary code execution or denial of service. The vulnerability has a CVSS 4.0 score of 8.7, indicating high severity. There is currently no vendor-provided patch or official remediation information available.

Successful exploitation of this vulnerability could allow a remote attacker to cause a stack-based buffer overflow in the affected device's web management interface. This may result in arbitrary code execution, system instability, or denial of service. The vulnerability affects the confidentiality, integrity, and availability of the device, as indicated by the high CVSS impact metrics. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the device's web management interface to trusted networks only and monitor for unusual activity. Avoid exposing the management interface to untrusted networks or the internet.