CVE-2026-11498: Tenda HG7HG9/HG10 Web Management voip_other_set asp_voip_OtherSet stack-based overflow

Synopsis

A stack-based buffer overflow affects the web management interface of Tenda HG7HG9 and HG10 routers running firmware version 300001138_en_xpon. The vulnerability is reachable over the network by an attacker with a low-privilege account, requiring no victim interaction; it resides in the asp_voip_OtherSet function at /boaform/voip_other_set when the funckey_transfer argument is manipulated with oversized input. Successful exploitation gives an attacker full read, write, and crash capability over the affected device. No upstream fix has been published; HarborGuard tracks this advisory for patch availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must be able to reach the device's web management interface over the network; no physical or local access is required.

• AuthenticationRequired

  A low-privilege account on the web management interface is sufficient; no administrative credentials are needed.

• Victim interactionNot required

  No user action or social engineering is needed; the attacker sends a crafted HTTP request directly to the vulnerable endpoint.

• Attack complexityDetail

  Attack complexity is low, meaning the overflow is reliably triggered without race conditions or special environmental prerequisites.

Blast Radius

• Reads sensitive data stored or processed by the device, including VoIP configuration, credentials, and any data accessible to the management process.
• Writes arbitrary data to the stack, enabling an attacker to overwrite return addresses and redirect execution to attacker-controlled code.
• Crashes the affected web management service or the entire device, causing a denial of service and loss of network management access.
• Remote code execution on the router gives the attacker a persistent foothold on the network edge, allowing traffic inspection or lateral movement to connected segments.