A critical command injection vulnerability in the Tenda HG10 router allows unauthenticated remote attackers to execute arbitrary system commands, posing a high risk of total device compromise.

This is a command injection vulnerability (CWE-77) residing in the Boa web server component. An unauthenticated attacker can exploit this by sending a crafted POST request to the /boaform/formSamba endpoint, specifically targeting the serverString parameter, which lacks necessary input sanitization before execution.

Successful exploitation of this vulnerability allows an attacker to gain full control over the affected networking hardware. This could lead to unauthorized access to internal network traffic, modification of device configurations, or the use of the router as a pivot point for lateral movement within the business environment. Given the CVSS score of 7.3, this flaw represents a significant security risk that could facilitate further intrusion into sensitive infrastructure.

Immediate Action: Since a specific patch is not currently available, administrators should immediately restrict access to the web management interface of the Tenda HG10 device to trusted management networks only.

Proactive Monitoring: Monitor device logs for unusual POST requests directed at the /boaform/formSamba endpoint or unexpected shell command patterns originating from the web server process.

Compensating Controls: Deploy a Web Application Firewall (WAF) or an Intrusion Prevention System (IPS) configured to inspect traffic for command injection patterns, specifically targeting shell metacharacters within HTTP POST parameters.

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the technical write-up by the vulnerability researcher.

Given the availability of public exploit code and the critical nature of command injection, this vulnerability poses an immediate threat to the confidentiality and integrity of the local network. Organizations using the affected Tenda firmware must isolate these devices from the public internet immediately and prioritize firmware updates if and when the vendor provides a remediation.