CVE-2026-2910
📋 TL;DR
A remote stack-based buffer overflow vulnerability in Tenda HG9 routers allows attackers to execute arbitrary code by manipulating the pingAddr parameter in the /boaform/formPing6 endpoint. This affects Tenda HG9 routers with firmware version 300001138. Attackers can exploit this from the internet without authentication.
💻 Affected Systems
- Tenda HG9
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete device compromise leading to persistent backdoor installation, network traffic interception, lateral movement to internal networks, and botnet recruitment.
Likely Case
Remote code execution allowing attackers to modify router settings, intercept traffic, or use the device as a pivot point for internal attacks.
If Mitigated
Limited impact if device is behind firewall with restricted WAN access, though internal attackers could still exploit.
🎯 Exploit Status
Exploit code is publicly available on GitHub. Attack requires sending crafted HTTP POST request to vulnerable endpoint.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://www.tenda.com.cn/
Restart Required: Yes
Instructions:
1. Check Tenda website for firmware updates. 2. Download latest firmware. 3. Access router admin panel. 4. Navigate to firmware upgrade section. 5. Upload and apply new firmware. 6. Reboot router.
🔧 Temporary Workarounds
Disable WAN Management Access
allPrevent external access to router management interface
Access router admin panel -> Advanced Settings -> Remote Management -> Disable
Network Segmentation
allIsolate router management interface to separate VLAN
🧯 If You Can't Patch
- Replace affected router with different model/brand
- Place router behind firewall with strict inbound rules blocking port 80/443 from WAN
🔍 How to Verify
Check if Vulnerable:
Check router firmware version in admin panel. If version is 300001138, device is vulnerable.Check Version:
curl -s http://router-ip/ | grep -i version OR check admin panel System StatusVerify Fix Applied:
Verify firmware version has changed from 300001138 to a newer version after update.📡 Detection & Monitoring
Log Indicators:
- HTTP POST requests to /boaform/formPing6 with unusual pingAddr parameter length
- Router crash/reboot logs
- Unusual process execution in router logs
Network Indicators:
- HTTP traffic to router IP on port 80/443 with POST to vulnerable endpoint
- Unusual outbound connections from router
SIEM Query:
source="router_logs" AND (url="/boaform/formPing6" OR "pingAddr" AND content_length>100)