A critical OS command injection vulnerability in the Tenda HG10 router firmware enables remote, unauthenticated attackers to execute arbitrary commands with root privileges.

The vulnerability exists within the formgponConf function of the Boa web server. By sending a crafted POST request to the /boaform/admin/formgponConf endpoint, an unauthenticated attacker can inject malicious shell commands into the fmgpon_loid parameter, which the system executes without proper sanitization.

Successful exploitation of this vulnerability grants an attacker full control over the affected network device. Given the critical 9.9 CVSS score, this flaw poses an extreme risk, as it allows for complete system compromise, potential lateral movement into local networks, and persistent denial of service. The ability to execute commands remotely without authentication makes this an ideal target for botnets and unauthorized surveillance.

Immediate Action: There is currently no official patch available from the vendor. Users should immediately restrict access to the web management interface of the Tenda HG10 to trusted management networks only and disable remote management features.

Proactive Monitoring: Monitor network traffic for unusual POST requests targeting the /boaform/admin/formgponConf URI and check system logs for anomalous process execution or unexpected device reboots.

Compensating Controls: Deploy a Web Application Firewall (WAF) or an Intrusion Prevention System (IPS) with signatures configured to block requests containing shell metacharacters in the fmgpon_loid parameter.

Public Exploit Available: Yes, a functional proof-of-concept demonstrating command injection via the specified endpoint is documented in the referenced security research.

Due to the critical nature of this command injection vulnerability and the availability of public exploit documentation, immediate action is required. Organizations using Tenda HG10 devices must isolate them from the public internet and restrict administrative access until a firmware update is released by the manufacturer. Failure to apply these compensating controls leaves the device exposed to full remote compromise.