Sunnyyaya

**Name of the Vulnerable Software and Affected Versions** Tenda HG10 (affected versions not specified) **Description** A flaw in the Boa component allows remote attackers to perform OS command injection. The issue exists within the `formgponConf()` function located in the `/boaform/admin/formgponConf` file, where improper handling of the `fmgpon loid` variable enables the execution of arbitrary system commands. **Recommendations** As a temporary workaround, restrict access to the `/boaform/admin/formgponConf` endpoint to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Tenda HG10 (affected versions not specified) **Description** A remote buffer overflow exists in the `formURL()` function within the `/boaform/admin/formURL` endpoint. This issue occurs when the `Keywd/urlFQDN` argument is manipulated, potentially allowing an attacker to trigger the overflow remotely. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Tenda HG10 (affected versions not specified) **Description** A buffer overflow exists in the Boa Web Server component within the `formWanRedirect()` function of the `/boaform/formWanRedirect` endpoint. A remote attacker can trigger this issue by manipulating the `if` argument. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Tenda HG10 300001138 (affected versions not specified) **Description** A buffer overflow exists in the Boa Web Server component within the `formWlanSetup()` function of the `/boaform/formWlanSetup` file. This issue occurs when the `ssid` argument is manipulated, allowing for remote exploitation. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict access to the `/boaform/formWlanSetup` endpoint to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Tenda HG10 300001138 (affected versions not specified) **Description** A buffer overflow can be triggered remotely within the Boa Web Server component. The issue exists in the `formLogin()` function located in the `/boaform/formLogin` file when the `Username` argument is manipulated. A buffer overflow occurs when a program writes more data to a block of memory, or buffer, than it is allocated to hold, potentially leading to crashes or arbitrary code execution. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict access to the `/boaform/formLogin` endpoint to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Tenda HG10 (affected versions not specified) **Description** A buffer overflow exists in the Boa Web Server component. The issue occurs within the `formIPv6Routing()` function located in the `/boaform/admin/formIPv6Routing` endpoint. A remote attacker can trigger this by manipulating the `destNet` argument. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Tenda AC8 version 16.03.33.05 **Description** A buffer overflow issue exists in the Embedded Httpd Service component of Tenda AC8. The flaw is located in the file '/goform/fast setting wifi set' and is triggered by manipulating the `timeZone` argument. Remote exploitation is possible. The exploit has been published. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Tenda AC8 version 16.03.33.05 **Description** A buffer overflow issue exists in the `fromSetWifiGusetBasic` function within the `/goform/WifiGuestSet` file of the `httpd` component. The `shareSpeed` argument can be manipulated to trigger this issue, potentially allowing for remote attacks. The exploit for this issue is publicly available. **Recommendations** Update to a newer version that contains a fix for this vulnerability. As a temporary workaround, consider restricting access to the `fromSetWifiGusetBasic` function until a patch is available.