CVE-2026-2907

7.4 highEPSS 0.6%

A weakness has been identified in Tenda HG9 300001138. Affected by this vulnerability is an unknown functionality of the file /boaform/formgponConf of the component GPON Configuration Endpoint. This manipulation of the argument fmgpon_loid/fmgpon_loid_password causes stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks.

Severity

CVSS 4.0

7.4 high

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P

CVSS 3.1

8.8 high

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.6% chance of exploitation in the next 30 days; higher than 50% of CVEs (scores of 2026-10-31)
CWEs: CWE-119, CWE-121
Published: 2026-02-22
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

tenda:hg9_firmware

References

https://github.com/QIU-DIE/cve-nneeww/issues/9
https://vuldb.com/?ctiid.347216
https://vuldb.com/?id.347216
https://vuldb.com/?submit.755201
https://www.tenda.com.cn/

Check your stack JSON