CVE-2026-1687mediumCWE-74CWE-77

CVE-2026-1687: falha de média gravidade em Tenda HG10

Tenda HG10 Boa Webserver formSamba command injection

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar HG10

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 6.9epss 3.2%
A weakness has been identified in Tenda HG10 US_HG7_HG9_HG10re_300001138_en_xpon. Impacted is an unknown function of the file /boaform/formSamba of the component Boa Webserver. Executing a manipulation of the argument serverString can lead to command injection. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Produtos afetados
Tenda · HG10
CVEs relacionadas — Tenda HG10

No mesmo produto, das mais perigosas para as menos.

CVE-2026-11499CRITICALTenda HG7/HG9/HG10 formDOMAINBLK stack-based overflowEPSS 6.6%CVE-2026-1690MEDIUMTenda HG10 formSysCmd system command injectionEPSS 4.7%CVE-2026-11498HIGHTenda HG7/HG9/HG10 Web Management voip_other_set asp_voip_OtherSet stack-based overflowEPSS 3.8%CVE-2026-1689MEDIUMTenda HG10 Login formLogin checkUserFromLanOrWan command injectionEPSS 3.1%CVE-2026-86167CRITICALTenda HG10 Boa formgponConf os command injectionEPSS 2.7%CVE-2026-86165CRITICALTenda HG10 formURL buffer overflowEPSS 1.1%