CVE-2026-11553: Tenda HG7HG9/HG10 formPPPEdit stack-based overflow

Synopsis

A stack-based buffer overflow affects the formPPPEdit function in Tenda HG7HG9, HG9, and HG10 routers running firmware version 300001138_en_xpon. The vulnerability is reachable over the network by any authenticated user with a low-privilege account, triggered by sending a crafted value in the encodename argument to /boaform/formPPPEdit. Successful exploitation gives an attacker full read, write, and availability impact on the device, including the ability to execute arbitrary code. No fix version has been published; HarborGuard is tracking the advisory for patch availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable endpoint /boaform/formPPPEdit is exposed over the network, so the attacker must be able to reach the device's web interface remotely.

• AuthenticationRequired

  The attack requires a low-privilege authenticated session; any standard user account on the device is sufficient to trigger the overflow.

• Victim interactionNot required

  No victim interaction is needed; the attacker sends a crafted HTTP request directly to the vulnerable endpoint without involving another user.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other environmental factors.

Blast Radius

• Reads sensitive configuration data stored on the device, including PPP credentials and network settings.
• Writes arbitrary data to the stack, enabling execution of attacker-controlled code on the device.
• Crashes or reboots the affected router, disrupting network connectivity for all clients behind it.
• A public proof-of-concept exploit is already available, lowering the bar for exploitation significantly.