CVE-2026-11498: Tenda Router VoIP Buffer Overflow RCE Vulnerability

Technical summary

The vulnerability exists in the asp_voip_OtherSet function within the /boaform/voip_other_set endpoint of Tenda's web management interface. The function fails to properly validate the length of the 'funckey_transfer' parameter before copying it into a fixed-size stack buffer. This classic stack-based buffer overflow (CWE-121) allows an authenticated attacker to overwrite the stack, including saved return addresses and local variables. By crafting a payload exceeding the buffer's capacity, an attacker can execute arbitrary code with the privileges of the web server process, typically running as root on these embedded devices.

Business impact

Compromise of a Tenda router exposes an organization's entire network to reconnaissance, lateral movement, and persistent backdoor installation. An attacker controlling the router can intercept, modify, or redirect all network traffic, monitor VoIP calls, harvest credentials, and establish a foothold for further attacks. For organizations relying on these routers as network perimeter devices or for remote office connectivity, exploitation could lead to data exfiltration, ransomware deployment, or business continuity disruption.

Affected systems

Tenda HG7, HG9, and HG10 routers running firmware version 300001138_en_xpon are confirmed vulnerable. Organizations should verify the exact firmware version on deployed units—it typically appears in the router's web interface under system information. Tenda has not released public details on which firmware versions introduced or remediated this issue; checking the vendor's security advisory is essential to identify the full scope of affected revisions.

Exploitability

The attack requires valid credentials to access the web management interface, reducing the immediate risk for routers with strong default credentials changed post-deployment. However, many organizations fail to change default credentials, and attackers often target routers on public IP ranges or through compromised employee accounts. Once inside, the exploit is straightforward—no complex timing, architecture-specific bypasses, or advanced techniques are needed. The CVSS 3.1 score of 8.8 (HIGH) reflects the high impact, low complexity, and network accessibility, though the requirement for prior authentication moderately constrains the base metric.

Remediation

Immediately apply any available firmware update from Tenda addressing CVE-2026-11498. In the interim, restrict web management access via firewall rules to trusted IP ranges or internal networks only. Disable remote management if not required. Change default credentials on all affected routers. Implement network segmentation to minimize the blast radius if a router is compromised. Consider replacing the affected models with routers from vendors with stronger security track records and timely patch release practices.

Patch guidance

Consult Tenda's official security advisory and support portal for patched firmware versions. Do not rely on third-party repositories. After updating, verify the firmware version in the router's system information and confirm that the web management interface no longer accepts oversized funckey_transfer parameters (test safely in a lab if possible). Maintain a log of all firmware versions deployed across your infrastructure to track remediation progress.

Detection guidance

Monitor web server logs on the router (if accessible) for POST requests to /boaform/voip_other_set with unusually long or malformed funckey_transfer values. On the network level, look for unexpected traffic patterns to the router's web management port from internal hosts, particularly from user machines that should not need router administration access. Intrusion detection systems may flag oversized parameter payloads if configured with VoIP protocol-aware rules. Consider deploying a WAF or proxy in front of the router if it is internet-exposed for any service.

Why prioritize this

This vulnerability ranks high due to the combination of network accessibility, high impact (full device compromise), and likely prevalence of unchanged default credentials in deployed Tenda routers. While it requires authentication, the ease of exploitation and the critical role of network infrastructure justify immediate attention. Organizations with publicly accessible routers or weak access controls should prioritize patching or isolating these devices within 30 days.

Risk score, explained

The CVSS 3.1 score of 8.8 reflects a HIGH severity vulnerability: network attack vector (AV:N), low attack complexity (AC:L), but low privilege requirement (PR:L)—meaning only a low-level authenticated user is needed. The impact scope is unchanged (S:U), but all three impact categories—confidentiality, integrity, and availability—are rated high (C:H, I:H, A:H). The authentication requirement prevents a maximum score but does not reduce the threat significantly if credential compromise or default credentials are common in your environment.

Frequently asked questions