EUVD-2026-25913Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privilege web-UI session
-
DeliveryReach /boaform/formIPv6Routing endpoint
-
ExploitSend oversized destNet parameter
-
ExecutionOverflow stack buffer in formUploadConfig
-
PersistHijack control flow / crash device
-
ImpactExecute code or deny service on router
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Stack buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires reaching the router's web management interface and issuing a request to the /boaform/formIPv6Routing endpoint invoking the formUploadConfig function with an over-length destNet parameter - the specific IPv6 routing configuration feature must be accessible. Per CVSS PR:L, the attacker needs a low-privilege authenticated session (a valid or default web-UI login), so this is not fully unauthenticated. Limiting factors: the management interface is typically LAN-facing in SOHO deployments (not internet-reachable unless remote administration is enabled), no user interaction is needed (UI:N), and the bug is specific to Tenda HG3 2.0 firmware; SSVC rates it Automatable: no, indicating it is not trivially mass-scanned/exploited. |
| Impact | Signals conflict in a way that lowers effective priority despite a 'total' technical impact. The CVSS 4.0 base score of 7.4 (AV:N/AC:L/AT:N/PR:L/UI:N, full VC/VI/VA:H) indicates a network-reachable, low-complexity flaw requiring only low privileges. However, EPSS is 0.05% (14th percentile) - very low - and CISA SSVC classifies it as Exploitation: poc (not active) and Automatable: no, meaning it is not readily wormable or mass-exploitable. It is NOT on the CISA KEV list. The PR:L requirement means an attacker needs at least a valid low-privilege session (or default/weak credentials) on the device's web interface, and in typical SOHO deployments the management interface is LAN-facing rather than internet-exposed, further constraining the 'network' vector. Net assessment: a genuine, exploitable memory-corruption bug with a public PoC, but real-world urgency is moderate - closer to targeted or opportunistic LAN-side abuse than widespread automated exploitation. Note: the AV:N rating assumes reachability that in practice usually depends on the management UI being exposed; verify actual exposure in your environment. |
| Exploit ScenarioDerived | An attacker with a low-privilege session on the Tenda HG3 web interface (e.g., via default or weak credentials on the LAN) sends a crafted POST to /boaform/formIPv6Routing with an oversized destNet value, overflowing the stack buffer in formUploadConfig. This crashes the device (denial of service) or, with a tailored payload against the unprotected embedded stack, executes attacker code to take control of the router. A public proof-of-concept exploit has been disclosed, lowering the effort required to reproduce the attack. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 24, 2026
Stack-based buffer overflow in the Tenda HG3 2.0 router allows authenticated remote attackers to corrupt memory by supplying an oversized destNet parameter to the formUploadConfig handler at the /boaform/formIPv6Routing endpoint. Publicly available exploit code exists, though EPSS rates real-world exploitation probability very low (0.05%, 14th percentile) and there is no public exploit identified as actively exploited. Successful exploitation yields total impact to confidentiality, integrity, and availability, typically manifesting as device crash or arbitrary code execution on the embedded system.
RemediationAI
No vendor-released patch identified at time of analysis - the references include only the VulDB record (https://vuldb.com/vuln/359750) and the Tenda homepage (https://www.tenda.com.cn/), with no fixed firmware version disclosed. As compensating controls: restrict access to the router's web management interface so it is reachable only from trusted LAN hosts and never exposed to the WAN/internet (disable any remote-management/WAN administration option), which prevents remote reach at the cost of losing off-LAN administration; change default credentials and enforce strong passwords to raise the bar on the required PR:L session; and segment the device onto a management VLAN to limit which clients can reach /boaform/. Monitor Tenda's support channels for updated HG3 2.0 firmware and apply it once released. If the device is end-of-life or no fix appears, consider replacing it with a supported router. Avoid exposing the IPv6 routing configuration workflow to untrusted users.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is the web management interface of the Tenda HG3, a consumer/SOHO networking device that runs a Boa-style embedded HTTP server exposing CGI-like handlers under /boaform/. The vulnerable routine formUploadConfig processes the destNet argument (an IPv6 routing destination network field) without adequate bounds checking, and copies attacker-controlled input into a fixed-size stack buffer. This is a classic CWE-121 Stack-based Buffer Overflow: because the return address and saved registers live adjacent to the buffer on the stack, overflowing it can redirect control flow. Such flaws are common in MIPS/ARM embedded firmware where compiler stack protections (canaries, ASLR, NX) are frequently absent, making memory corruption more directly exploitable than on modern desktop platforms. The CPE cpe:2.3:a:tenda:hg3:*:*:*:*:*:*:*:* identifies the Tenda HG3 product line as affected.
Know when Hg3 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Network-reachable web endpoint with low-complexity overflow; PR:L because a low-privilege web-UI session is required; full C/I/A loss from memory-corruption code execution on the device.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability was determined in Tenda HG3 2.0. Impacted is the function formUploadConfig of the file /boaform/formIPv6Routing. This manipulation of the argument destNet causes stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized.
Executive ViewAI
Organizations operating Tenda HG3 2.0 routers face potential network disruption from a publicly disclosed buffer overflow vulnerability that could crash devices or enable remote code execution. Exploitation requires valid administrative credentials, and no confirmed exploitation attempts have been observed, reducing near-term operational risk despite the public availability of exploit code.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict administrative access by source IP address to approved management networks only, disable IPv6 Routing configuration feature if unused, deploy intrusion detection rules targeting /boaform/formIPv6Routing endpoint for exploitation attempts, place routers behind firewall with restricted inbound access, monitor for unexpected device reboots or connectivity loss, and maintain backups of router configurations.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than it was allocated to hold.
Command injection in the Tenda HG3 2.0 gateway/router allows an authenticated remote attacker to inject arbitrary OS com
OS command injection in Tenda HG3 router version 2.0 (build 300003070) allows authenticated remote attackers to execute
GitHub PoC
Exploit-DB