CVE-2026-82542: Buffer Overflow in Tenda HG10

This vulnerability involves a buffer overflow in the formIPv6Routing function of the Boa Web Server component on the Tenda HG10 device (version 300001138). The issue arises from improper handling of the destNet argument, allowing remote attackers to cause a buffer overflow. The vulnerability is remotely exploitable without any privileges or user interaction, leading to a critical severity rating (CVSS 10.0). No vendor advisory or patch information is currently available, and the vulnerability was published on 2026-08-30. Exploit code has been publicly released, increasing the risk of potential attacks.

Successful exploitation of this vulnerability could allow remote attackers to execute arbitrary code or cause a denial of service on affected Tenda HG10 devices. Given the critical CVSS score and the nature of buffer overflow vulnerabilities, this could lead to complete compromise of the device. However, there are no confirmed reports of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider limiting network exposure of the affected device and monitoring for unusual activity related to IPv6 routing configuration attempts. Avoid exposing the device's management interface to untrusted networks.