CVE-2026-82542: A perfect 10.0 in a router nobody patches

The National Vulnerability Database entry for CVE-2026-82542 is a masterclass in understatement. A weakness in the Tenda HG10, model 300001138. The function formIPv6Routing in the file /boaform/admin/formIPv6Routing, part of the Boa Web Server component. Manipulation of the destNet argument causes a buffer overflow. The attack can be carried out remotely. The exploit is public.

And the severity score? A perfect 10.0 on the CVSS scale. The maximum possible rating, reserved for vulnerabilities that are remotely exploitable, require no authentication, and compromise confidentiality, integrity, and availability with no user interaction. This one earns every point.

The gap between the dry NVD language and the 10.0 score is where the real story lives. This is not a zero-day in a hyperscaler’s cloud platform. It is a buffer overflow in an IPv6 routing form handler on a consumer router that most owners will never update. The CVSS score is technically correct. It is also practically meaningless for the people who need it most.

The anatomy of a perfect score

CVSS 10.0 ratings are rare precisely because they demand the worst of everything. The vector for CVE-2026-82542 checks every box. Network attack vector means no physical access required. Low attack complexity means no special conditions. No privileges required means no authentication. No user interaction means no phishing lure needed. The impact on confidentiality, integrity, and availability is total.

The mechanism itself is unglamorous. The Boa Web Server is an embedded HTTP server with a long history in consumer networking gear. It is lightweight, which made it attractive for devices with limited memory and processing power. It is also old, and its form handlers have been a recurring source of memory-corruption bugs for years. The formIPv6Routing function takes user-supplied input from the destNet argument and copies it into a fixed-size buffer without proper bounds checking. An attacker sends a crafted HTTP request to the router’s management interface, the stack overflows, and code execution follows.

The public exploit makes this worse. NVD notes the exploit has been made available, which means the barrier to entry dropped from reverse-engineering the firmware to downloading a script. Any attacker with a script and a network path to the device can attempt exploitation. For a router, that network path is often the internet itself, because consumer devices frequently expose management interfaces on the WAN side either by default or through UPnP misconfiguration.

The AI angle nobody is talking about

Here is where the story intersects with the AI economy, and it is not the angle the security press will lead with. The Tenda HG10 is not an AI device. It has no neural accelerator, no on-device inference, no clever NPU for local voice assistants. But it sits at the edge of the AI infrastructure stack, and that position matters more than its compute specs.

AI workloads are migrating to the edge. Small language models run on phones, on laptops, on home hubs. The economics of inference push work off centralized data centers and toward distributed devices. Every one of those endpoints needs network connectivity, and consumer routers are the choke point. A router with a public exploit is not just a compromised device. It is a foothold for lateral movement into every other device on the home network, including the ones doing local inference.

Consider what an attacker does with a compromised HG10. They control the DNS responses, the routing tables, the traffic inspection. If a home lab runs a local model server for privacy reasons, the router sits between that server and the clients that query it. A compromised router can redirect model requests to a malicious endpoint, poison responses, or exfiltrate prompts and outputs. The entire privacy benefit of local inference evaporates when the network path is hostile.

This is the supply-chain problem that the AI industry has not priced in. Model providers invest heavily in securing their training clusters and inference APIs. They run red teams, bug bounties, and dedicated security engineering. The last mile, the consumer router that carries the traffic, is a 10.0 vulnerability with a public exploit and no patch in sight.

The patch problem

The Tenda HG10 is a budget router. It sells for tens of dollars, not hundreds. The vendor’s incentive to ship a firmware update for a device that is likely years old, possibly out of warranty, and certainly superseded by newer models is minimal. The NVD entry does not indicate a patch is available. The device is effectively end-of-life from a security perspective, even if it remains in service.

This is the structural failure of IoT security. The CVSS score assumes a remediation path exists. It measures severity, not fixability. A 10.0 that gets patched in 48 hours is a different risk than a 10.0 that never gets patched. The latter is the norm for consumer networking gear, and the score does not distinguish between the two.

The economics are perverse. The cost of a thorough security review and ongoing patch support for a budget router exceeds the profit margin on the device itself. The vendor ships the hardware, collects the revenue, and moves on. The residual risk is externalized to the consumer, who has no way to assess it and no recourse when the patches stop.

What this means for AI builders

For anyone building AI products that touch consumer networks, CVE-2026-82542 is a warning about the assumptions baked into the deployment model. If your product assumes a trustworthy network path, you have built on sand. The router between the user and your service, or between the user and their local model, is an unpatched liability.

The practical response is defense in depth. Encrypt traffic end to end so a compromised router cannot read it. Authenticate clients so a compromised router cannot impersonate them. Assume the network is hostile, because with a public exploit and a perfect CVSS score, it demonstrably is.

The strategic response is to push security into the device lifecycle. AI hardware vendors building edge devices should treat the network stack as a first-class component, not an afterthought. The Boa Web Server is a legacy component with a known vulnerability history. Choosing it for a new product in 2026 is a decision that will come back as a CVE with your name on it.

The industry response is harder. There is no market mechanism that rewards a router vendor for patching a five-year-old device. Regulation is the only lever that changes the incentive structure, and it moves slowly. Until then, the Tenda HG10 and devices like it will sit on home networks, carrying a perfect 10.0 and a public exploit, waiting for someone to run the script.

The NVD entry is two sentences long. The problem it describes will outlast the device, the vendor’s support window, and probably the current generation of AI edge products. That is the real severity score, and it does not fit on a 0 to 10 scale.