CVE-2026-85110: Buffer Overflow in Tenda HG10

The vulnerability CVE-2026-85110 exists in the Tenda HG10 device within the formWlanSetup function of the Boa Web Server component. An attacker can remotely manipulate the ssid argument to trigger a buffer overflow condition. This flaw could potentially be exploited to execute arbitrary code or cause denial of service. The vulnerability has a CVSS 4.0 score of 8.7, indicating high severity, with network attack vector, low attack complexity, no privileges required, and no user interaction needed. Although exploit code is publicly available, there is no vendor advisory or patch information currently available.

Successful exploitation of this vulnerability can lead to remote code execution or denial of service on the affected Tenda HG10 device. The attacker can trigger a buffer overflow remotely without authentication or user interaction, which poses a significant risk to device integrity and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider limiting network exposure of the affected device and monitor for any suspicious activity related to the Boa Web Server component.