CVE-2026-2908
Published: 22 February 2026
Summary
CVE-2026-2908 is a high-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Tenda Hg9 Firmware. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 29.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Timely firmware remediation directly patches the stack-based buffer overflow in the Tenda HG9 router's /boaform/formLoopBack Loopback Detection Configuration Endpoint.
Validates the Ethtype argument to prevent stack-based buffer overflow exploitation in the Loopback Detection Configuration Endpoint.
Deploys memory protections such as stack canaries to block arbitrary code execution from the Ethtype-induced buffer overflow.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability is a remotely exploitable buffer overflow in a public-facing web management endpoint (/boaform/formLoopBack) on a router, enabling arbitrary code execution, which directly maps to Exploit Public-Facing Application (T1190).
NVD Description
A security vulnerability has been detected in Tenda HG9 300001138. Affected by this issue is some unknown functionality of the file /boaform/formLoopBack of the component Loopback Detection Configuration Endpoint. Such manipulation of the argument Ethtype leads to stack-based buffer overflow.…
more
The attack can be executed remotely. The exploit has been disclosed publicly and may be used.
Deeper analysisAI
CVE-2026-2908 is a stack-based buffer overflow vulnerability (CWE-119, CWE-121) affecting the Tenda HG9 router with firmware version 300001138, published on 2026-02-22. The flaw resides in an unknown functionality of the /boaform/formLoopBack file within the Loopback Detection Configuration Endpoint, where manipulation of the Ethtype argument triggers the overflow.
The vulnerability carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating it can be exploited remotely with low complexity by an attacker possessing low privileges, without requiring user interaction. Successful exploitation could grant high-impact access to confidentiality, integrity, and availability, potentially enabling arbitrary code execution through the buffer overflow.
Advisories and additional details are documented in references such as https://github.com/QIU-DIE/cve-nneeww/issues/10, https://vuldb.com/?ctiid.347217, https://vuldb.com/?id.347217, https://vuldb.com/?submit.755202, and the vendor site https://www.tenda.com.cn/. The exploit has been publicly disclosed and may be usable.
Details
- CWE(s)