CVE-2026-11499

Tenda HG7/HG9/HG10 formDOMAINBLK stack-based overflow

CVSS 4.0 9.3 CRITICALCVSS 3.1 9.8 CRITICALCVSS 3.0 9.8 CRITICALCVSS 2.0 10.0 Check source for fixed versionsKEV status unknown

Original advisory

Historical advisory recorded 23 Oct 2026 15:48:27 UTC. Read the latest advisory.

cve-program · CVE-2026-11499

Published

A vulnerability was determined in Tenda HG7, HG9 and HG10 300001138_en_xpon. This affects the function formDOMAINBLK of the file /boaform/formDOMAINBLK. Executing a manipulation of the argument blkDomain can lead to stack-based buffer overflow. The attack may be performed from remote.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-11499

Published

HG7

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Tenda",
                    "product": "HG7",
                    "versions": [
                        {
                            "version": "300001138_en_xpon",
                            "status": "affected"
                        }
                    ],
                    "cpes": [
                        "cpe:2.3:h:tenda:hg7:*:*:*:*:*:*:*:*"
                    ]
                }

HG9

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Tenda",
                    "product": "HG9",
                    "versions": [
                        {
                            "version": "300001138_en_xpon",
                            "status": "affected"
                        }
                    ],
                    "cpes": [
                        "cpe:2.3:h:tenda:hg9:*:*:*:*:*:*:*:*"
                    ]
                }

HG10

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Tenda",
                    "product": "HG10",
                    "versions": [
                        {
                            "version": "300001138_en_xpon",
                            "status": "affected"
                        }
                    ],
                    "cpes": [
                        "cpe:2.3:h:tenda:hg10:*:*:*:*:*:*:*:*"
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON