A critical command injection vulnerability in the Tenda HG10 router allows unauthenticated remote attackers to achieve arbitrary code execution on the device.

The vulnerability exists in the checkUserFromLanOrWan function within the formLogin interface of the Boa web server. An unauthenticated attacker can inject arbitrary shell commands into the Host parameter, which are then passed to the system shell without sanitization.

Successful exploitation allows an attacker to gain complete control over the affected network device. This facilitates unauthorized access to internal network traffic, potential interception of credentials, and the ability to use the device as a pivot point for further attacks on the internal infrastructure. With a CVSS score of 7.3, this represents a significant risk to network integrity and confidentiality, particularly for edge devices exposed to the internet.

Immediate Action: Since a vendor patch is currently unknown, immediately restrict access to the device management interface by disabling remote management (WAN-side access) and limiting access to trusted local IP addresses.

Proactive Monitoring: Monitor device logs for unusual shell-related activity or suspicious HTTP requests containing command separators (e.g., semicolons or pipe characters) directed at the login endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) or an Intrusion Prevention System (IPS) rule to inspect and block incoming HTTP requests where the Host header contains non-standard characters or shell metacharacters.

Public Exploit Available: Yes, a proof-of-concept is documented in the referenced security research write-up.

Given the availability of public proof-of-concept code and the ease of exploitation, this vulnerability poses an immediate threat to exposed Tenda HG10 devices. Administrators should prioritize isolating these devices from the public internet until a firmware update from Tenda Technology is verified and applied.