CVE-2026-1687 MEDIUM

CVE-2026-1687: Tenda HG10 Boa Webserver formSamba command injection

Vendor Tenda

Product HG10

Weakness CWE-77

Published January 30, 2026

Last update February 23, 2026

View on NVD All CVEs

CVSS base score

6.9/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction None

Confidentiality —

Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

What the vulnerability does

01Description

A weakness has been identified in Tenda HG10 US_HG7_HG9_HG10re_300001138_en_xpon. Impacted is an unknown function of the file /boaform/formSamba of the component Boa Webserver. Executing a manipulation of the argument serverString can lead to command injection. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks.

Key dates

02Disclosure timeline

January 30, 2026 CVE published

February 23, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-1687 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/77.html

Related vulnerabilities

04Related CVE

CVE-2025-5113 Authenticated Remote Command Injection in Diviotec NBR IP Cameras CVE-2025-53107 @cyanheads/git-mcp-server vulnerable to command injection in several tools CVE-2026-8345 D-Link DIR-816 singlePortForward sub_445E7C command injection CVE-2023-0628 Docker Desktop before 4.17.0 allows an attacker to execute an arbitrary command inside a Dev Environments container during initialization by tricking a user to open a crafted malicious docker-desktop:// URL CVE-2025-14225 D-Link DCS-930L alphapd setSystemAdmin command injection