Cyber Posture

CVE-2026-2908

HighPublic PoC

Published: 22 February 2026

Published
22 February 2026
Modified
23 February 2026
KEV Added
Patch
CVSS Score 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0011 29.3th percentile
Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Description

A security vulnerability has been detected in Tenda HG9 300001138. Affected by this issue is some unknown functionality of the file /boaform/formLoopBack of the component Loopback Detection Configuration Endpoint. Such manipulation of the argument Ethtype leads to stack-based buffer overflow.…

more

The attack can be executed remotely. The exploit has been disclosed publicly and may be used.

Mitigating Controls (NIST 800-53 r5)AI

prevent

Timely firmware remediation directly patches the stack-based buffer overflow in the Tenda HG9 router's /boaform/formLoopBack Loopback Detection Configuration Endpoint.

prevent

Validates the Ethtype argument to prevent stack-based buffer overflow exploitation in the Loopback Detection Configuration Endpoint.

prevent

Deploys memory protections such as stack canaries to block arbitrary code execution from the Ethtype-induced buffer overflow.

Security SummaryAI

CVE-2026-2908 is a stack-based buffer overflow vulnerability (CWE-119, CWE-121) affecting the Tenda HG9 router with firmware version 300001138, published on 2026-02-22. The flaw resides in an unknown functionality of the /boaform/formLoopBack file within the Loopback Detection Configuration Endpoint, where manipulation of the Ethtype argument triggers the overflow.

The vulnerability carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating it can be exploited remotely with low complexity by an attacker possessing low privileges, without requiring user interaction. Successful exploitation could grant high-impact access to confidentiality, integrity, and availability, potentially enabling arbitrary code execution through the buffer overflow.

Advisories and additional details are documented in references such as https://github.com/QIU-DIE/cve-nneeww/issues/10, https://vuldb.com/?ctiid.347217, https://vuldb.com/?id.347217, https://vuldb.com/?submit.755202, and the vendor site https://www.tenda.com.cn/. The exploit has been publicly disclosed and may be usable.

Details

CWE(s)

Affected Products

tenda
hg9 firmware
300001138

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Why these techniques?

The vulnerability is a remotely exploitable buffer overflow in a public-facing web management endpoint (/boaform/formLoopBack) on a router, enabling arbitrary code execution, which directly maps to Exploit Public-Facing Application (T1190).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References