CVE-2026-85109

A vulnerability was determined in Tenda HG10 300001138. This issue affects the function formLogin of the file /boaform/formLogin of the component Boa Web Server. Executing a manipulation of the argument Username can lead to buffer overflow. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized.

  • Published Sep 3, 2026
  • CVSS 8.9 high
  • 1.1% chance of exploitation in the next 30 days (EPSS)

Affected software

CVE-2026-85109 at the National Vulnerability Database