Tenda HG3 firmware 2.0 includes a vulnerability in the /boaform/formCountrystr handler that allows an attacker to inject and execute arbitrary OS commands via manipulation of the countrystr argument. The flaw is exploitable from remote. Based on the description, it is inferred that the vulnerability can be exploited without authentication, giving the attacker the ability to run commands with the privileges of the web interface process. This results in full compromise of the device and any network functions it performs.

The affected system is the Tenda HG3 router running firmware version 2.0. The vulnerability resides in an unknown function within the file /boaform/formCountrystr and is present in all units using this firmware. No other vendors or product lines are listed.

The CVSS score of 8.7 indicates a high severity flaw. With no EPSS score available and the vulnerability not listed in the CISA KEV catalog, the likelihood of exploitation depends on threat actor interest; however, the remote command injection vector and, based on the description, it is inferred that the vulnerability may be exploitable without authentication, making it a prime target for automated attacks. If exploited, an attacker can gain unrestricted command execution on the device, potentially enabling full network takeover.