This vulnerability involves a buffer overflow in the formRoute function within the Boa Service component of Tenda HG10 devices running the specified firmware version. The issue arises from improper validation or handling of the nextHop argument, enabling remote attackers to trigger a buffer overflow condition. The vulnerability has a CVSS 4.0 base score of 8.7, indicating high severity with network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability. Although exploit code is publicly available, there is no indication of active exploitation in the wild. No patch or official remediation level has been published by the vendor as of the data provided.

Successful exploitation of this vulnerability could allow remote attackers to cause a buffer overflow, potentially leading to arbitrary code execution, denial of service, or system compromise on affected Tenda HG10 devices. The high CVSS score reflects significant impact on confidentiality, integrity, and availability. However, no active exploitation has been confirmed in the wild, and the exploit requires no privileges or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider limiting network exposure of affected devices, applying network-level protections such as firewall rules to restrict access to the vulnerable service, and monitoring for unusual activity. Avoid relying on generic mitigations unless specifically recommended by the vendor.