CVE-2026-86166

A vulnerability was determined in Tenda HG10 300001138. This issue affects the function formWanRedirect of the file /boaform/formWanRedirect of the component Boa Web Server. Executing a manipulation of the argument if can lead to buffer overflow. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized.

  • Published Sep 6, 2026
  • CVSS 7.4 high
  • 0.9% chance of exploitation in the next 30 days (EPSS)

Affected software

CVE-2026-86166 at the National Vulnerability Database