This vulnerability in Tenda HG7HG9 and HG10 300001138_en_xpon firmware involves a stack-based buffer overflow in the formDOMAINBLK function of the /boaform/formDOMAINBLK file. An attacker can remotely manipulate the blkDomain argument to cause the overflow. The vulnerability is remotely exploitable without authentication and has a critical CVSS 4.0 score of 9.3, reflecting high impact on confidentiality, integrity, and availability. No vendor advisory or patch information is provided, and no known exploits are reported in the wild as of the publication date.

Successful exploitation of this vulnerability can lead to remote code execution or denial of service on affected Tenda HG7HG9 and HG10 devices. The critical CVSS score indicates a high likelihood of severe impact on device operation and security, potentially allowing attackers to fully compromise the device remotely without any privileges or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, network-level protections such as restricting access to the affected device's management interfaces from untrusted networks may reduce exposure. Monitor vendor channels for updates and apply patches promptly once available.