CVE-2026-1687 | Tenda HG10 US_HG7_HG9_HG10re_300001138_en_xpon Boa Webserver /boaform/formSamba serverString command injection

A vulnerability was found in Tenda HG10 US_HG7_HG9_HG10re_300001138_en_xpon and classified as critical. Impacted is an unknown function of the file /boaform/formSamba of the component Boa Webserver. Executing a manipulation of the argument serverString can lead to command injection.

This vulnerability is registered as CVE-2026-1687. It is possible to launch the attack remotely. Furthermore, an exploit is available.