Which versions of Tenda HG3 are affected by CVE-2026-7160?

Tenda HG3 2.0 gateways contain an authenticated command injection vulnerability (CVE-2026-7160) that enables remote code execution on critical network infrastructure.

Is there a public PoC exploit available for CVE-2026-7160?

Yes, a public proof-of-concept exploit is available for CVE-2026-7160. Prioritise patching immediately. EPSS: 0.3%.

How to fix or mitigate CVE-2026-7160?

Within 24 hours, conduct a complete inventory of all Tenda HG3 2.0 devices in production and restrict administrative access to only essential personnel via VPN with multi-factor authentication. Within 7 days, implement network segmentation (separate VLANs or isolated subnets) to isolate affected gateways from production systems, and enable all available command execution and authentication logging. Within 30 days, establish a vendor communication channel with Tenda for patch notification, develop and execute a replacement plan for affected units, and conduct a security assessment of any administrative credentials used on these devices to identify lateral movement risks.

Tenda HG3 CVE-2026-7160

Q: What is the CVSS score of CVE-2026-7160?

CVE-2026-7160 has a CVSS 4.0 base score of 7.4 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-25927 HIGH

Command Injection (CWE-77)

2026-04-27 VulDB

Command Injection Tenda Hg3

7.4

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

7.4 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.8 HIGH

Network-reachable web endpoint with low complexity but requires an authenticated low-privilege session (PR:L); command injection yields full OS compromise, so C/I/A all High, scope unchanged.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 04:56 vuln.today

PoC Detected

Apr 30, 2026 - 18:23 vuln.today

Public exploit code

CVSS changed

Apr 27, 2026 - 22:22 NVD

8.8 (HIGH) 7.4 (HIGH)

EUVD ID Assigned

Apr 27, 2026 - 22:00 euvd

EUVD-2026-25927

CVE Published

Apr 27, 2026 - 21:30 nvd

HIGH 7.4

DescriptionCVE.org

A vulnerability was determined in Tenda HG3 2.0. This vulnerability affects the function formTracert of the file /boaform/formTracert. Executing a manipulation of the argument datasize can lead to command injection. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized.

AnalysisAI

Command injection in the Tenda HG3 2.0 gateway/router allows an authenticated remote attacker to inject arbitrary OS commands through the formTracert handler at /boaform/formTracert by manipulating the datasize argument (CWE-77). Publicly available exploit code exists (disclosed via VulDB), though there is no public exploit identified as being actively used in the wild and it is not listed in CISA KEV. EPSS is modest at 0.29% (52nd percentile), indicating exploitation is plausible but not yet widespread.

Technical ContextAI

The Tenda HG3 is a consumer/SOHO networking gateway whose web management interface is served by a BOA-style embedded HTTP server (evident from the /boaform/ endpoint path). The vulnerable formTracert function implements a network diagnostic 'traceroute' feature that passes the user-supplied datasize parameter into an underlying shell command without adequate sanitization, matching CWE-77 (Improper Neutralization of Special Elements used in a Command). Because diagnostic utilities on embedded Linux firmware typically shell out to system binaries, unescaped metacharacters (e.g. ;, |, `, $()) in datasize are interpreted by the shell, yielding arbitrary command execution in the router's OS context. The single affected CPE is cpe:2.3:a:tenda:hg3:*:*:*:*:*:*:*:*.

RemediationAI

No vendor-released patch or fixed firmware version is identified in the available data at time of analysis; the only vendor reference is the general Tenda site (https://www.tenda.com.cn/), so monitor it and the VulDB advisory (https://vuldb.com/vuln/359759) for a firmware update and apply it once released. As compensating controls: ensure the router's web management interface is never exposed to the WAN/Internet (disable remote administration) so the network-reachable vector is limited to the LAN; place management on a restricted VLAN or ACL so only trusted admin hosts can reach /boaform/; and replace any default or weak administrator credentials to blunt the PR:L requirement, since the exploit needs an authenticated session. These controls reduce reachability at the cost of losing convenient remote management. Given the device class and unknown patch timeline, replacing an end-of-support unit with a maintained model is a reasonable long-term option.