Which versions of Tenda HG3 are affected by CVE-2026-7096?

CVE-2026-7096 is a command injection vulnerability in Tenda HG3 routers (v2.0 build 300003070) that permits authenticated administrators to execute arbitrary system commands with full router…

Is there a public PoC exploit available for CVE-2026-7096?

Yes, a public proof-of-concept exploit is available for CVE-2026-7096. Prioritise patching immediately. EPSS: 0.3%.

How to fix or mitigate CVE-2026-7096?

Within 24 hours: Inventory all Tenda HG3 devices running version 2.0 build 300003070 and document administrative account holders. Within 7 days: Restrict administrative access to Tenda HG3 devices to named, monitored accounts; disable remote administration if not operationally required; enable logging of all administrative function calls. Within 30 days: Contact Tenda for patch availability and timeline; if no patch emerges, evaluate replacement with patched router models or alternative vendors; implement network segmentation to isolate router management interfaces from general user traffic.

Tenda HG3 CVE-2026-7096

Q: What is the CVSS score of CVE-2026-7096?

CVE-2026-7096 has a CVSS 4.0 base score of 7.4 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-25786 HIGH

OS Command Injection (CWE-78)

2026-04-27 VulDB

Tenda Command Injection

7.4

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

7.4 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

PoC Detected

Apr 30, 2026 - 16:18 vuln.today

Public exploit code

Analysis Updated

Apr 27, 2026 - 08:28 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Apr 27, 2026 - 08:22 vuln.today

cvss_changed

CVSS changed

Apr 27, 2026 - 08:22 NVD

8.8 (HIGH) 7.4 (HIGH)

Analysis Generated

Apr 27, 2026 - 07:45 vuln.today

EUVD ID Assigned

Apr 27, 2026 - 07:30 euvd

EUVD-2026-25786

Analysis Generated

Apr 27, 2026 - 07:30 vuln.today

CVE Published

Apr 27, 2026 - 06:45 nvd

HIGH 7.4

DescriptionCVE.org

A security flaw has been discovered in Tenda HG3 2.0 300003070. This vulnerability affects the function formgponConf of the file /boaform/admin/formgponConf. The manipulation of the argument fmgpon_loid results in os command injection. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks.

AnalysisAI

OS command injection in Tenda HG3 router version 2.0 (build 300003070) allows authenticated remote attackers to execute arbitrary system commands with router privileges via the fmgpon_loid parameter in the formgponConf administrative function. Public exploit code is available and confirmed usable for attacks per VulDB reporting, significantly lowering the skill barrier for exploitation despite requiring valid administrative credentials.

Technical ContextAI

This vulnerability affects the GPON (Gigabit Passive Optical Network) configuration interface of Tenda HG3 routers, specifically in the formgponConf function accessible at /boaform/admin/formgponConf. The flaw is a classic OS command injection (CWE-78) where unsanitized user input from the fmgpon_loid parameter (GPON Logical ONU ID) is passed directly to a system shell command. The affected product is identified by CPE cpe:2.3:a:tenda:hg3:*:*:*:*:*:*:*:* version 2.0 build 300003070. GPON optical network terminals typically run embedded Linux systems with limited input validation in web administration interfaces, making them frequent targets for command injection attacks. The administrative web interface uses the BOA web server, a lightweight HTTP server common in embedded devices.

RemediationAI

Check Tenda support site (https://www.tenda.com.cn/) for firmware updates beyond version 2.0 build 300003070, though no vendor-released patch is confirmed in available data at time of analysis. If firmware updates are unavailable or delayed, implement these compensating controls with noted trade-offs: (1) Disable remote administrative access to the router web interface and restrict management to local network only (reduces usability for remote management but eliminates network attack vector); (2) Change default administrative credentials to strong unique passwords exceeding 16 characters (mitigates credential stuffing but requires user action); (3) Implement network segmentation to isolate the vulnerable router from critical assets (limits lateral movement post-compromise but requires network redesign); (4) Deploy intrusion detection signatures monitoring for command injection patterns in HTTP POST requests to /boaform/admin/formgponConf (provides detection but not prevention); (5) If GPON configuration is not actively used, disable or restrict access to the formgponConf function through router configuration if possible (eliminates attack surface but may impact ISP-managed GPON features). Monitor VulDB entries https://vuldb.com/vuln/359671 and vendor advisories for patch availability.