This vulnerability affects the Tenda HG10 device firmware version HG7_HG9_HG10re_300001138_en_xpon. The issue is a buffer overflow in the formRoute function of the /boaform/formRouting component in the Boa Service. The vulnerability arises from improper handling of the nextHop argument, allowing remote attackers to cause a buffer overflow. The CVSS 4.0 base score is 8.7, indicating high severity with network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability. An exploit has been published, but there is no vendor-provided patch or official remediation information available.

Successful exploitation of this vulnerability can lead to remote code execution or denial of service on affected Tenda HG10 devices. The attacker can trigger a buffer overflow remotely without authentication or user interaction, potentially compromising device confidentiality, integrity, and availability. The published exploit increases the risk of attack, although no confirmed exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary mitigation has been published, users should monitor vendor communications for updates. Until a patch is available, restricting network access to the device's management interface and applying network-level protections may reduce exposure.