426,677 titles against 12,055 fingerprints: locating the Tenda gateways behind CVE-2026-104610
CVE-2026-104610 affects the Tenda HG7, HG9 and HG10 fibre gateways. Finding them from outside is harder than the headline severity suggests, because the obvious query and the accurate query return very different populations.
What we measured
Two queries were run against ZoomEye on 2026-10-04 (UTC), both at sub_type=all with a page size of one:
-
title="Tenda"returned 426,677 matching services. -
app="Tenda"returned 12,055 matching services. The first number counts anything whose HTML title contains the vendor name. That includes the vendor's product pages, reseller listings, documentation mirrors, and the router interfaces themselves. The second number is the application fingerprint the platform assigns to Tenda devices. For an inventory of devices, the fingerprint is the closer estimate, and 12,055 is the defensible figure.
Why the title match is the wrong query
Title-based searches on a consumer networking brand are noisy by construction. A page titled "Tenda N300 Wireless Router" is a shop page. A device interface is usually titled with a generic login string or a model number rather than the brand. The title query therefore over-counts non-devices and under-counts real ones, sometimes in the same result set.
The honest conclusion is that neither query identifies which gateways are affected models. The HG7, HG9 and HG10 are carrier-supplied fibre terminals, and a carrier-grade deployment rarely advertises a marketing title. The device may answer HTTP with a minimal page and a firmware string, which is what the application fingerprint is built from.
That is a general lesson about exposure measurement: for consumer and carrier equipment, the relationship between searchable metadata and the affected population is weak. The measurement describes discoverability, not deployment.
What the number is good for
The 12,055 figure is still useful, for a specific purpose. It establishes that a meaningful population of Tenda-fingerprinted assets is reachable from the internet, which is the precondition for remote exploitation of CVE-2026-104610. It also sets an expectation for the scale of any coordinated response: this is not a handful of devices.
For an operator, the productive version of the exercise is to combine the fingerprint with a scope filter. Adding a country, org or cidr term restricts the same dork to the ranges you care about, and the resulting count is an exposure number for a real estate rather than for the internet. That is the form in which the measurement supports a decision.
From exposure to remediation
The remediation path for CVE-2026-104610 does not depend on the count. Where a vulnerable HG7, HG9 or HG10 is reachable on its management interface from the WAN side, that exposure should be closed first, because the exploit is public and needs no authentication. Restricting management to an administrative VLAN and removing the WAN-side listener are controls that work whether or not Tenda has shipped a fix.
Detection is available in the interim. Requests to /boaform/formLoopBack with an unusually long Ethtype value are distinctive, and an alert on that pattern costs little to add.
The measurement closes one gap and leaves the important one open: knowing that Tenda devices are on the internet does not tell you which are the affected models. That answer comes from the carrier or from the device itself, and it is the step no external index can perform.
