CVE-2026-85109PoC

LOWCVSS 8.9 · HIGH

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft
Track advisory updates for patch or workaround availability

Recommended action window: High priority (within 72h)

NVD description

A vulnerability was determined in Tenda HG10 300001138. This issue affects the function formLogin of the file /boaform/formLogin of the component Boa Web Server. Executing a manipulation of the argument Username can lead to buffer overflow. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized.

Back to dashboard

1.5/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-119CWE-120

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

NONE

Momentum

NONE

Threat summary

Public PoC is present in monitored signal
1 mentions across 1 observed day

What's happening

PoC mentioned or linked in 1 signal
Technical details provided in 1 signal
1 total mentions across 1 day

Deep dive

Activity timeline1 mentions / 1d

Signal classification1 categories

PoC

1100.0%

Referenced assets1 URL

By indicator

https://secalerts.co/vulnerability/CVE-2026-85109?utm_campaign=x

Full discourse1 post

SecAlerts@SecAlertsCo46d
PoC
🔓 Unauthenticated buffer overflow in Tenda HG10's Boa Web Server via the formLogin endpoint. CVE-2026-85109 scores 8.9 with a public PoC — no login needed to hit C/I/A. Check your exposure now. #cybersecurity #vulnerabilities #ciso #msp https://secalerts.co/vulnerability/CVE-2026-85109?utm_campaign=x https://t.co/t6hx1YpgyB
Post summary
The tweet informs about an unauthenticated buffer overflow (CVE‑2026‑85109) in Tenda HG10’s Boa Web Server, noting a public proof‑of‑concept and urging users to verify exposure.
0000087
889 followersView on X

Explore more

Back to dashboard