{"id":"CVE-2026-86167","title":"A vulnerability was identified in Tenda HG10 300001138","summary":"A vulnerability was identified in Tenda HG10 300001138. Impacted is the function formgponConf of the file /boaform/admin/formgponConf of the component Boa. The manipulation of the argument fmgpon_loid leads to os command injection. Remot…","severity":"critical","cvss":9.9,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cwe":["CWE-77","CWE-78"],"vendor":"Tenda","product":"HG10","affected":["HG10 300001138"],"published":"2026-09-06","updated":"2026-09-08","sourceUpdated":"2026-09-08T18:21:15.533","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-86167","references":[{"url":"https://github.com/SunnyYANGyaya/cuicuishark-sheep-fishIOT/blob/main/Tenda/HG10/command-formgponConf-fmgpon_loid.md","label":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-86167","label":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/895596","label":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/399306","label":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/399306/cti","label":"cna@vuldb.com"},{"url":"https://www.tenda.com.cn/","label":"cna@vuldb.com"}],"tags":["nvd","cve.org","exploit-available"],"exploitAvailable":true,"ssvc":{"exploitation":"poc","automatable":"no","technicalImpact":"total","timestamp":"2026-09-08T17:45:51.458509Z"},"epss":0.0163,"epssPercentile":0.74767,"ingestedAt":"2026-09-06T16:57:43.613Z","slug":"CVE-2026-86167","body":"## Overview\n\nA vulnerability was identified in Tenda HG10 300001138. Impacted is the function formgponConf of the file /boaform/admin/formgponConf of the component Boa. The manipulation of the argument fmgpon_loid leads to os command injection. Remote exploitation of the attack is possible. The exploit is publicly available and might be used.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"abyssal","depthScore":67,"depthScoreParts":{"impact":54.5,"likelihood":0.3,"exploitation":12,"ransomware":0},"changes":[{"seq":8313,"id":"CVE-2026-86167","ts":1788919997300,"field":"exploit_available","old":"false","new":"true"},{"seq":8122,"id":"CVE-2026-86167","ts":1788919286674,"field":"exploit_available","old":"true","new":"false"},{"seq":7931,"id":"CVE-2026-86167","ts":1788916358658,"field":"exploit_available","old":"false","new":"true"},{"seq":7740,"id":"CVE-2026-86167","ts":1788915304099,"field":"exploit_available","old":"true","new":"false"},{"seq":7549,"id":"CVE-2026-86167","ts":1788912719032,"field":"exploit_available","old":"false","new":"true"},{"seq":7358,"id":"CVE-2026-86167","ts":1788911336710,"field":"exploit_available","old":"true","new":"false"},{"seq":7162,"id":"CVE-2026-86167","ts":1788909080587,"field":"exploit_available","old":"false","new":"true"},{"seq":6974,"id":"CVE-2026-86167","ts":1788907393640,"field":"exploit_available","old":"true","new":"false"},{"seq":6776,"id":"CVE-2026-86167","ts":1788905446386,"field":"exploit_available","old":"false","new":"true"},{"seq":6594,"id":"CVE-2026-86167","ts":1788903460585,"field":"exploit_available","old":"true","new":"false"},{"seq":6380,"id":"CVE-2026-86167","ts":1788901812386,"field":"exploit_available","old":"false","new":"true"},{"seq":6210,"id":"CVE-2026-86167","ts":1788899562855,"field":"exploit_available","old":"true","new":"false"},{"seq":5973,"id":"CVE-2026-86167","ts":1788898181285,"field":"exploit_available","old":"false","new":"true"},{"seq":5862,"id":"CVE-2026-86167","ts":1788895711889,"field":"exploit_available","old":"true","new":"false"},{"seq":5690,"id":"CVE-2026-86167","ts":1788894534799,"field":"exploit_available","old":"false","new":"true"},{"seq":5648,"id":"CVE-2026-86167","ts":1788891871731,"field":"exploit_available","old":"true","new":"false"},{"seq":5600,"id":"CVE-2026-86167","ts":1788890891169,"field":"exploit_available","old":"false","new":"true"}]}