External risk intelligence

Tenda HG7HG9 HG10 Stack Buffer Overflow Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-11499

The vulnerability affects Tenda home gateway/router devices. These devices are designed to be internet-facing by default, providing connectivity between the public internet and local networks. As network edge equipment, they are commonly exposed to remote network requests in normal operation.

Memory Corruption

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in Tenda gateway devices, specifically impacting the handling of domain blocking functions. This issue allows for remote exploitation through manipulation of a specific argument, potentially leading to significant system compromise. The main concern at this time is confirming if these affected devices are present within our environment.

Attackers can overflow device memory remotely.
Gateway devices are internet-facing by default.
Confirm relevance and exposure to Tenda gateways.

Attack Path

How an attacker could exploit the issue

An attacker can remotely reach a Tenda router and trigger a stack-based buffer overflow by manipulating a specific argument in a web interface function. This vulnerability could allow an attacker to gain significant control over the device.

Entry: Internet-facing router.
Trigger: Manipulated web request argument.
Risk: Code execution and device compromise.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to overwrite critical memory by sending specially crafted requests to the affected device's web interface. This could lead to a disruption of the device's network functions.

Device network functions at risk.
Remote requests could trigger overflow.
Service disruption and loss of connectivity.

Operational Fix

Recommended remediation, mitigation, and detection steps

The affected Tenda devices, commonly used as network edge equipment, are likely managed by infrastructure or network operations teams, with vendor management involved if this is a procured device. The first practical step is to identify all instances of these Tenda devices across the environment, confirm their internet reachability and business criticality, and then assign ownership for remediation planning.

Identify accountable infrastructure/network teams.
Verify device exposure and criticality.
Plan coordinated remediation actions.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Tenda HG7, HG9, and HG10?

These are models of Tenda home gateways or routers. They serve as network edge equipment that manages traffic between a local network and the public internet, acting as the primary connection point for home or small office environments.

What is the stack-based buffer overflow in CVE-2026-11499?

This is a memory corruption weakness, specifically categorized under CWE-121. It occurs when a program writes more data to a memory area on the stack than it can hold. In this CVE, manipulating a specific input argument allows an attacker to overwrite adjacent memory, potentially altering the device's execution flow.

How is this vulnerability triggered?

An attacker triggers this by sending a specially crafted request to the device's web management interface, specifically targeting the formDOMAINBLK function. The flaw is not triggered by normal, legitimate traffic; it requires the malicious manipulation of the 'blkDomain' argument.

Is my device at risk based on Halo Surface Signal?

Yes, if you use these Tenda models, you should be concerned. Halo Surface Signal identifies these routers as internet-facing by design. Because they sit at the edge of your network to provide connectivity, they are reachable by remote network requests, making them prime targets for this vulnerability.

What should I do if I run these Tenda devices?

Your first step is to locate all instances of these specific Tenda routers within your network. Once identified, evaluate whether they are directly reachable from the internet, assess their business criticality, and coordinate with your infrastructure or network operations teams to plan and prioritize a remediation strategy.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.