CVE-2026-2907 Details

A stack-based buffer overflow vulnerability has been identified in the Tenda HG9 router, specifically in the GPON configuration endpoint '/boaform/formgponConf' on firmware version 300001138. The vulnerability arises from the improper handling of the 'fmgpon_loid' and 'fmgpon_loid_password' parameters. The 'sprintf' function is used to format a command string into a local stack buffer named '_bin_omcicli_set_loid', which is allocated only 128 bytes on the stack. This unbounded string formatting allows for user-controlled input to overflow the buffer, overwrite the return address, and potentially execute arbitrary code remotely, or cause a denial-of-service by crashing the web interface.

It is recommended to replace the vulnerable 'sprintf' function with 'snprintf' to prevent buffer overflows. Additionally, input validation should be implemented to enforce strict length limits on the 'fmgpon_loid' and 'fmgpon_loid_password' parameters before processing them.