CVE-2026-11499: Tenda HG7HG9/HG10 formDOMAINBLK stack-based overflow

Synopsis

A stack-based buffer overflow affects the formDOMAINBLK function in Tenda HG7HG9, HG9, and HG10 routers running firmware version 300001138_en_xpon. The vulnerability is reachable over the network without any authentication, by sending a crafted value in the blkDomain argument to the /boaform/formDOMAINBLK endpoint. Successful exploitation gives an attacker full control over the device, including the ability to execute arbitrary code. No fix has been published; HarborGuard tracks this advisory for patch availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the device's web management interface over the network; the vulnerable endpoint is exposed via HTTP from a remote origin.

• AuthenticationNot required

  No account or credential of any privilege level is needed to submit a request to the formDOMAINBLK endpoint.

• Victim interactionNot required

  The attacker sends a crafted HTTP request directly to the device; no user action or interaction is required.

• Attack complexityDetail

  Exploit conditions are straightforward and reliable, with no race conditions, memory-layout dependencies, or other environmental factors required.

Blast Radius

• Attacker executes arbitrary code on the router with the privilege level of the web server process, gaining a foothold on the device.
• Attacker reads stored configuration data including credentials, Wi-Fi passphrases, and network topology details.
• Attacker modifies device configuration, redirecting DNS, disabling firewall rules, or adding rogue administrative accounts.
• Attacker crashes or reboots the device, disrupting network connectivity for all downstream hosts.