CVE-2026-1689 | Tenda HG10 US_HG7_HG9_HG10re_300001138_en_xpon Login Interface /boaform/admin/formLogin checkUserFromLanOrWan Host command injection

A vulnerability was found in Tenda HG10 US_HG7_HG9_HG10re_300001138_en_xpon. It has been declared as critical. The impacted element is the function checkUserFromLanOrWan of the file /boaform/admin/formLogin of the component Login Interface. The manipulation of the argument Host results in command injection.

This vulnerability is reported as CVE-2026-1689. The attack can be launched remotely. Moreover, an exploit is present.