Which versions of Tenda HG3 are affected by CVE-2026-7151?

Organizations operating Tenda HG3 2.0 routers face potential network disruption from a publicly disclosed buffer overflow vulnerability that could crash devices or enable remote code execution.

Is there a public PoC exploit available for CVE-2026-7151?

Yes, a public proof-of-concept exploit is available for CVE-2026-7151. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-7151?

Within 24 hours: Inventory all Tenda HG3 2.0 routers in production environments and disable remote administrative access (SSH, web management) from the internet if currently enabled. Within 7 days: Restrict administrator credentials to trusted network segments only, disable the IPv6 Routing configuration feature if not operationally required, and enable logging of all administrative actions on affected routers. Within 30 days: Evaluate complete replacement of affected devices with alternatives from vendors offering active security patching, or confirm with Tenda whether firmware updates addressing CVE-2026-7151 are available and deploy them.

Tenda HG3 CVE-2026-7151

Q: What is the CVSS score of CVE-2026-7151?

CVE-2026-7151 has a CVSS 4.0 base score of 7.4 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-25913 HIGH

Stack-based Buffer Overflow (CWE-121)

2026-04-27 VulDB

Tenda Stack Overflow Buffer Overflow Hg3

7.4

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

7.4 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.8 HIGH

Network-reachable web endpoint with low-complexity overflow; PR:L because a low-privilege web-UI session is required; full C/I/A loss from memory-corruption code execution on the device.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 05:03 vuln.today

PoC Detected

Apr 30, 2026 - 18:22 vuln.today

Public exploit code

CVSS changed

Apr 27, 2026 - 20:22 NVD

8.8 (HIGH) 7.4 (HIGH)

EUVD ID Assigned

Apr 27, 2026 - 20:00 euvd

EUVD-2026-25913

CVE Published

Apr 27, 2026 - 19:15 nvd

HIGH 7.4

DescriptionCVE.org

A vulnerability was determined in Tenda HG3 2.0. Impacted is the function formUploadConfig of the file /boaform/formIPv6Routing. This manipulation of the argument destNet causes stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized.

AnalysisAI

Stack-based buffer overflow in the Tenda HG3 2.0 router allows authenticated remote attackers to corrupt memory by supplying an oversized destNet parameter to the formUploadConfig handler at the /boaform/formIPv6Routing endpoint. Publicly available exploit code exists, though EPSS rates real-world exploitation probability very low (0.05%, 14th percentile) and there is no public exploit identified as actively exploited. Successful exploitation yields total impact to confidentiality, integrity, and availability, typically manifesting as device crash or arbitrary code execution on the embedded system.

Technical ContextAI

The affected component is the web management interface of the Tenda HG3, a consumer/SOHO networking device that runs a Boa-style embedded HTTP server exposing CGI-like handlers under /boaform/. The vulnerable routine formUploadConfig processes the destNet argument (an IPv6 routing destination network field) without adequate bounds checking, and copies attacker-controlled input into a fixed-size stack buffer. This is a classic CWE-121 Stack-based Buffer Overflow: because the return address and saved registers live adjacent to the buffer on the stack, overflowing it can redirect control flow. Such flaws are common in MIPS/ARM embedded firmware where compiler stack protections (canaries, ASLR, NX) are frequently absent, making memory corruption more directly exploitable than on modern desktop platforms. The CPE cpe:2.3:a:tenda:hg3:*:*:*:*:*:*:*:* identifies the Tenda HG3 product line as affected.

RemediationAI

No vendor-released patch identified at time of analysis - the references include only the VulDB record (https://vuldb.com/vuln/359750) and the Tenda homepage (https://www.tenda.com.cn/), with no fixed firmware version disclosed. As compensating controls: restrict access to the router's web management interface so it is reachable only from trusted LAN hosts and never exposed to the WAN/internet (disable any remote-management/WAN administration option), which prevents remote reach at the cost of losing off-LAN administration; change default credentials and enforce strong passwords to raise the bar on the required PR:L session; and segment the device onto a management VLAN to limit which clients can reach /boaform/. Monitor Tenda's support channels for updated HG3 2.0 firmware and apply it once released. If the device is end-of-life or no fix appears, consider replacing it with a supported router. Avoid exposing the IPv6 routing configuration workflow to untrusted users.