e76f01z/tenda-hg10-rceCVE-2026-1689 Unauthenticated RCE for the Tenda HG10
A command injection vulnerability exists in the Tenda HG10 router. It occurs in the formLogin endpoint due to improper handling of the Host parameter.
No authentication credentials are verified as this executes before the check.
User input from the Host header is directly executed as a command without validation:
ifconfig br0 | grep 'inet6' | grep '<user_input>'
A simple script (exploit.go) is included, which accepts a file containing IP:port/URL pairs for mass exploitation.
Over +100k devices are active, and over +15k have already been tested & verified as vulnerable.
