Cyber & AI intelligence
Wasteland.
Briefs indexed2452
Issues26
Published Mondays07:30 CT
CVE · Critical CVE-2026-86167 2026-09-06

CVE-2026-86167: Command Injection in Tenda HG10 Boa Web Interface

"A publicly disclosed OS command injection flaw in the Tenda HG10 gateway's Boa web server lets a low-privileged remote attacker execute arbitrary commands, carrying a CVSS 3.1 score of 9.9 (Critical)."

A publicly disclosed OS command injection flaw in the Tenda HG10 gateway's Boa web server lets a low-privileged remote attacker execute arbitrary commands, carrying a CVSS 3.1 score of 9.9 (Critical).

What Is It

CVE-2026-86167 is an OS command injection vulnerability (CWE-77, CWE-78) in Tenda HG10 firmware version 300001138. The flaw sits in the formgponConf function of /boaform/admin/formgponConf, part of the device's Boa web server component. Manipulation of the fmgpon_loid argument allows attacker-controlled input to reach an OS command context. Remote exploitation is possible, and per the VulDB record the exploit is publicly available and might be used.

Why It Matters

The CVSS 3.1 base score is 9.9 (CRITICAL), vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, network attack vector, low attack complexity, only low privileges required, no user interaction, and a changed scope with high confidentiality, integrity, and availability impact. The CVSS 4.0 assessment scores it 8.6 (HIGH) with exploit maturity rated PROOF_OF_CONCEPT and high impact to both the vulnerable system and downstream systems. Because scope is changed, successful command execution on the gateway can affect resources beyond the web server itself; a meaningful concern for an edge device sitting between a network and its upstream link.

The available source material reports exploit maturity as proof-of-concept and does not document confirmed in-the-wild exploitation. Public proof-of-concept detail is available on GitHub, which lowers the barrier to weaponization.

What's Vulnerable

Patch Status

The supplied source material lists no patch, fixed version, vendor advisory, or required remediation action. The CVE was published 2026-09-06. Operators should treat exposed HG10 management interfaces as untrusted and restrict network access to them pending vendor guidance.

Sources