Which versions of Tenda HG3 are affected by EUVD-2026-25834?

Tenda HG3 routers running version 2.0 contain a command injection vulnerability that allows authenticated users to execute arbitrary commands with full device privileges, potentially compromising…

How to fix or mitigate EUVD-2026-25834?

Within 24 hours: Inventory all Tenda HG3 routers in production and identify those running version 2.0; disable remote management access if enabled and restrict administrative access to trusted networks only. Within 7 days: Apply any available firmware updates from Tenda beyond version 2.0; if no patched version exists, implement network-level controls (WAF rules, access restrictions to /boaform endpoints). Within 30 days: Evaluate replacement or retirement of affected HG3 devices; if retention is necessary, establish continuous monitoring for suspicious command execution patterns and require multi-factor authentication for administrative access.

Tenda HG3 EUVD-2026-25834

Q: What is the CVSS score of EUVD-2026-25834?

EUVD-2026-25834 has a CVSS 4.0 base score of 7.4 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

| CVE-2026-7119 HIGH

Command Injection (CWE-77)

2026-04-27 cna@vuldb.com

Tenda Command Injection

7.4

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

7.4 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Re-analysis Queued

Apr 27, 2026 - 19:07 vuln.today

cvss_changed

Analysis Generated

Apr 27, 2026 - 12:30 vuln.today

EUVD ID Assigned

Apr 27, 2026 - 12:22 euvd

EUVD-2026-25834

Analysis Generated

Apr 27, 2026 - 12:22 vuln.today

CVE Published

Apr 27, 2026 - 12:16 nvd

HIGH 7.4

DescriptionCVE.org

A vulnerability was detected in Tenda HG3 2.0. The impacted element is an unknown function of the file /boaform/formCountrystr. The manipulation of the argument countrystr results in os command injection. The attack may be performed from remote. The exploit is now public and may be used.

AnalysisAI

OS command injection in Tenda HG3 router version 2.0 allows authenticated remote attackers to execute arbitrary commands with device privileges via the 'countrystr' parameter in /boaform/formCountrystr endpoint. Public exploit code exists (CVSS 4.0 E:P modifier confirms POC availability), enabling authenticated attackers to fully compromise router confidentiality, integrity, and availability. EPSS data unavailable; not currently in CISA KEV catalog, suggesting exploitation may be targeted rather than widespread despite public POC.

Technical ContextAI

The vulnerability (CWE-77: Command Injection) exists in the web management interface of Tenda HG3 consumer routers at firmware version 2.0. The /boaform/formCountrystr endpoint fails to sanitize user input in the 'countrystr' parameter before passing it to system command execution functions. This is a classic OS command injection flaw common in embedded device web interfaces where CGI-style form handlers directly interpolate user input into shell commands without proper escaping or validation. The 'boaform' path pattern is characteristic of BOA web server implementations frequently used in consumer networking equipment. Affected product identified from description and references: Tenda HG3 router firmware 2.0.

RemediationAI

Primary remediation: Check Tenda's official support site (www.tenda.com.cn) for firmware updates newer than version 2.0 addressing CVE-2026-7119; no vendor-released patch version was confirmed in available intelligence at time of analysis. Interim mitigations with trade-offs: (1) Restrict administrative interface access to trusted management networks only via firewall rules-blocks remote exploitation but requires network segmentation and may complicate legitimate remote management; (2) Change default administrative credentials to strong unique passwords-raises the authentication bar (PR:L) but does not eliminate risk if credentials are phished or brute-forced; (3) Disable remote management features entirely if not operationally required-most effective mitigation but eliminates remote administration capability. For internet-facing deployments, immediate isolation from WAN access is critical until patching. Reference vuldb.com/vuln/359719 for researcher's technical analysis and POC details.