CVE-2026-11553: Tenda Router Stack Buffer Overflow RCE Vulnerability

Technical summary

CVE-2026-11553 is a stack-based buffer overflow in the formPPPEdit function of Tenda router models HG7, HG9, and HG10 (firmware 300001138_en_xpon). The encodename argument is not properly bounds-checked before being written to stack memory. This classical memory safety issue (CWE-119, CWE-121) permits remote code execution or denial of service in the context of the web administration process. The vulnerability requires prior authentication but no additional user interaction.

Business impact

For organizations relying on Tenda routers for branch or remote office connectivity, this vulnerability poses a significant operational risk. A malicious insider or compromised administrative account could destabilize network access or establish persistent control over the device. Recovery requires manual intervention and potential downtime. Given the CVSS 8.8 severity and the published exploit, attackers are likely to incorporate this into attack chains targeting administrative access.

Affected systems

Tenda HG7, HG9, and HG10 routers running firmware version 300001138_en_xpon are affected. Verify your device model and firmware version via the administration interface. Consult the Tenda advisory to confirm whether your specific firmware build is in scope.

Exploitability

The exploit has been publicly disclosed as of June 2026. Exploitation requires valid login credentials to the router's web interface, reducing the attack surface to authenticated users. However, in environments where administrative credentials are shared, reused across devices, or compromised through phishing, the practical exploitability is elevated. The low complexity (AC:L) and network accessibility (AV:N) make this practical to weaponize once credentials are obtained.

Remediation

Immediately apply the latest firmware patch from Tenda for your router model. If patched firmware is not yet available, restrict access to the router's web administration interface using firewall rules or IP whitelisting. Disable remote management features if not strictly necessary. Audit administrator accounts and force password resets on privileged credentials. Monitor for unusual configuration changes on affected devices.

Patch guidance

Check the Tenda support portal for your router model (HG7, HG9, or HG10) and download the latest firmware release post-June 2026. Verify the firmware version number against the Tenda security advisory before deployment. Most Tenda devices support firmware updates via the web interface; follow the vendor's documented update procedure and avoid interrupting the process. Test in a non-production environment if possible.

Detection guidance

Monitor web server logs on the router for POST requests to /boaform/formPPPEdit with unusually long or malformed encodename parameters. Look for sudden restarts, crashes, or unresponsive administrative interfaces. Network-based detection is challenging without deep packet inspection; focus on access control auditing. Check for unauthorized changes to PPP configuration or unusual outbound connections initiated by the router process.

Why prioritize this

This is a high-severity, authenticated remote code execution in a network perimeter device with public exploit availability. While authentication is required, the impact spans confidentiality, integrity, and availability. Routers are high-value targets for maintaining persistence and lateral movement. Organizations should prioritize patching or containment within days, not weeks.

Risk score, explained

The CVSS 3.1 score of 8.8 (HIGH) reflects a network-accessible vulnerability with high impact across all three security properties (confidentiality, integrity, availability). The main mitigating factor is the requirement for prior authentication (PR:L). The public exploit and broad potential for use in supply chain or insider threat scenarios support urgent remediation.

Frequently asked questions