CVE-2026-86167

Name of the Vulnerable Software and Affected Versions Tenda HG10 (affected versions not specified)

Description A flaw in the Boa component allows remote attackers to perform OS command injection. The issue exists within the formgponConf() function located in the /boaform/admin/formgponConf file, where improper handling of the fmgpon loid variable enables the execution of arbitrary system commands.

Recommendations As a temporary workaround, restrict access to the /boaform/admin/formgponConf endpoint to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.