Description
A security flaw has been discovered in Tenda HG3 2.0 300003070. This vulnerability affects the function formgponConf of the file /boaform/admin/formgponConf. The manipulation of the argument fmgpon_loid results in os command injection. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks.
Published: 2026-04-27
Score: 8.7 High
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution
Action: Immediate Patch
AI Analysis

Impact

The vulnerability is an OS command injection in the formgponConf function of the Tenda HG3 control firmware. By manipulating the fmgpon_loid argument the attacker can inject arbitrary shell commands, allowing execution of code with the privileges of the firmware process. This leads to complete compromise of confidentiality, integrity, and availability of the device and all network services it manages.

Affected Systems

Manufactured by Tenda, the affected product is the HG3 router running firmware version 2.0 300003070. All installations using this build are susceptible.

Risk and Exploitability

The CVSS score of 8.7 classifies the flaw as a high‑severity remote code execution risk. The EPSS score is below 1 % indicating a low probability of exploitation, but a publicly available exploit has already been released and could be employed by motivated adversaries. The vulnerability is not listed in the CISA KEV catalog, yet the remote nature and command‑execution capability demand immediate attention.

Generated by OpenCVE AI on April 28, 2026 at 04:45 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Acquire and install the latest firmware release from Tenda that contains the fix for the formgponConf injection flaw.
  • Configure network perimeter controls to limit external access to the /boaform/admin/ endpoint, ensuring only trusted management IPs can reach it.
  • As a temporary measure, block or sanitize the fmgpon_loid parameter (e.g., via firewall or access‑control lists) so that no arbitrary commands can be passed to the firmware.

Generated by OpenCVE AI on April 28, 2026 at 04:45 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 30 Apr 2026 16:30:00 +0000

Type Values Removed Values Added
First Time appeared Tenda hg3 Firmware
CPEs cpe:2.3:h:tenda:hg3:2.0:*:*:*:*:*:*:*
cpe:2.3:o:tenda:hg3_firmware:300003070:*:*:*:*:*:*:*
Vendors & Products Tenda hg3 Firmware

Mon, 27 Apr 2026 20:45:00 +0000

Type Values Removed Values Added
First Time appeared Tenda
Tenda hg3
Vendors & Products Tenda
Tenda hg3

Mon, 27 Apr 2026 11:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Mon, 27 Apr 2026 07:30:00 +0000

Type Values Removed Values Added
Description A security flaw has been discovered in Tenda HG3 2.0 300003070. This vulnerability affects the function formgponConf of the file /boaform/admin/formgponConf. The manipulation of the argument fmgpon_loid results in os command injection. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks.
Title Tenda HG3 formgponConf os command injection
Weaknesses CWE-77
CWE-78
References
Metrics cvssV2_0

{'score': 9, 'vector': 'AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 8.8, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Tenda Hg3 Hg3 Firmware
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-04-27T11:02:25.326Z

Reserved: 2026-04-26T08:56:32.670Z

Link: CVE-2026-7096

cve-icon Vulnrichment

Updated: 2026-04-27T11:02:20.018Z

cve-icon NVD

Status : Analyzed

Published: 2026-04-27T08:16:02.527

Modified: 2026-04-30T16:18:03.660

Link: CVE-2026-7096

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-28T04:45:22Z

Weaknesses