VulnSocial

CVE-2026-86165Disclosure

MEDIUMCVSS 8.9 · HIGH

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

  • Patch affected systems immediately
  • Hunt for exploitation attempts and persistence artifacts
  • Increase monitoring for publicly documented tradecraft

Recommended action window: High priority (within 72h)

NVD description

A vulnerability was found in Tenda HG10 300001138. This vulnerability affects the function formURL of the file /boaform/admin/formURL. Performing a manipulation of the argument Keywd/urlFQDN results in buffer overflow. The attack may be initiated remotely. The exploit has been made public and could be used.

Back to dashboard
4.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-119CWE-120

Priority

MEDIUM

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Threat summary

  • Public PoC and exploit tooling are both present
  • Patch or workaround signal is available
  • 4 mentions across 4 observed days
  • Momentum state: stable

What's happening

  • Exploit tool or code specified in 2 signals
  • PoC mentioned or linked in 2 signals
  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 3 signals
  • Disclosure: 2 classified signals
  • Peaked 3d ago at 1 mentions (2026-09-05); latest day: 1
  • 4 total mentions across 4 days

Deep dive

Activity timeline4 mentions / 4d
00111Mentions · 2026-09-05: 1Mentions · 2026-09-06: 1Mentions · 2026-09-07: 1Mentions · 2026-09-08: 1PoC Mentioned / Linked · 2026-09-06: 1PoC Mentioned / Linked · 2026-09-08: 1Exploit Tool / Code · 2026-09-06: 1Exploit Tool / Code · 2026-09-08: 1Patch / Workaround · 2026-09-07: 1Technical Details · 2026-09-06: 1Technical Details · 2026-09-07: 1Technical Details · 2026-09-08: 109-0509-0609-0709-08
Signal classification3 categories
Disclosure
250.0%
Exploit
125.0%
PoC
125.0%
Referenced assets3 URLs
Classification over time
DateTotalLabels
2026-09-051
Disclosure1
2026-09-061
Exploit1
2026-09-071
Disclosure1
2026-09-081
PoC1
Full discourse4 posts
  • Rıdvan Yağlı@ridvanyagli
    Exploit

    🚨 Tenda HG10 (AC1200)'larda kritik güvenlik açığı! CVE-2026-86165, HG10 firmware 300001138'deki "/boaform/admin/formURL" endpoint'inde bulunan bir buffer overflow açığı. 🔴 CVSS 3.1: 9.8 Critical 🌐 Uzaktan tetiklenebiliyor 🔓 Kimlik doğrulama gerektirmiyor 💥 Public exploit mevcut! Saldırgan, "Keywd/urlFQDN" parametrelerini manipüle ederek bellek taşmasına neden olabiliyor. Dahası, aynı HG10 firmware'inde son günlerde birden fazla kritik güvenlik açığı daha ortaya çıktı. Cihazları internete açık şekilde kullananların özellikle dikkat etmesi gerekiyor.

    Post summary

    CVE-2026-86165 is a critical, remotely-triggered buffer overflow in Tenda HG10 firmware that has a publicly available exploit manipulating the Keywd/urlFQDN parameter; affected users should be alerted urgently.

    00022714
    2.4K followersView on X
  • ADK Cyber@ADKCyber
    Disclosure

    Critical CVE-2026-86165 (CVSS 10.0) in Tenda HG10. Organizations using this device should verify exposure and review available updates. https://adkcyber.com via NVD Recent High CVSS #CyberSecurity #InfoSec #Vulnerability #AI #MachineLearning https://t.co/AZ2VBbP55f

    Post summary

    A critical CVE‑2026‑86165 with CVSS 10.0 affecting Tenda HG10 has been disclosed, and users are urged to verify exposure and apply available updates.

    0000148
    93 followersView on X
  • SecAlerts@SecAlertsCo
    PoC

    📡 Tenda HG10 buffer overflow in formURL (/boaform/admin/formURL) via Keywd/urlFQDN — public PoC available. CVE-2026-86165 scores 8.9 with no auth required. Check your routers. #cybersecurity #vulnerabilities #ciso #msp https://secalerts.co/vulnerability/CVE-2026-86165?utm_campaign=x https://t.co/ns165yV9CY

    Post summary

    A public Proof‑of‑Concept for the Tenda HG10 buffer overflow (CVE‑2026‑86165, CVSS 8.9, no‑auth) has been released, with no indications of active exploitation or patch availability.

    0000084
    888 followersView on X
  • VulDB 🛡@vuldb
    Disclosure

    The severity is increased for this new vulnerability affecting Tenda HG10 (CVE-2026-86165) https://vuldb.com/vuln/399304

    Post summary

    The statement announces that the severity of the new Tenda HG10 vulnerability (CVE‑2026‑86165) has been increased, but it contains no technical, exploit, or mitigation details.

    00000123
    2.3K followersView on X

Explore more

Back to dashboard