A critical buffer overflow vulnerability in the Tenda HG10 router allows unauthenticated remote attackers to crash the device or potentially execute arbitrary code, posing a severe risk to network availability.

This memory corruption flaw exists within the Boa web server component, specifically in the formLogin function. An unauthenticated attacker can supply an excessively long username parameter via a POST request to the /boaform/formLogin endpoint, leading to a buffer overflow.

The ability for an unauthenticated attacker to remotely crash a network device leads to significant operational downtime and service disruption. Given the CVSS score of 9.8, this vulnerability represents a critical risk, as it allows for total loss of availability and potential full system compromise, which could facilitate further lateral movement within the internal network.

Immediate Action: Contact Tenda support or check the official Tenda website for available firmware updates to address this vulnerability. If no patch is currently available, restrict access to the web management interface to trusted internal IP addresses only.

Proactive Monitoring: Monitor network traffic for unusual POST requests directed at the /boaform/formLogin endpoint. Additionally, configure alerts for unexpected device reboots or service outages that may indicate successful exploitation.

Compensating Controls: Implement a Web Application Firewall (WAF) or an Intrusion Prevention System (IPS) rule to inspect and block HTTP requests containing overly long username parameters. Disable remote management access to the router to ensure the interface is not exposed to the public internet.

Public Exploit Available: Yes — a published proof-of-concept exists in the technical write-up referenced by the CVE record.

Due to the critical nature of this buffer overflow and the availability of a public proof-of-concept, immediate action is required to secure affected Tenda HG10 devices. Administrators should prioritize the application of vendor-supplied firmware updates and restrict administrative access to the device web interface to prevent unauthorized remote exploitation.