CVE-2026-11499

A vulnerability was determined in Tenda HG7HG9 and HG10 300001138_en_xpon. This affects the function formDOMAINBLK of the file /boaform/formDOMAINBLK. Executing a manipulation of the argument blkDomain can lead to stack-based buffer overflow. The attack may be performed from remote.

Affected products

Hg10, Hg7Hg9

CVSS 2.0

10.0 HIGH

CVSS 3.1

9.8 CRITICAL

EPSS

6.6% (93th percentile)

Weakness

CWE-119, CWE-121

NVD status

Deferred

Published

2026-06-08