Tenda HG3 EUVD-2026-25927

Exploitation requires reaching the router's embedded web server and the specific diagnostic endpoint /boaform/formTracert (the formTracert traceroute feature), then supplying command-injection payloads in the datasize argument. Per the CVSS vector (PR:L), the attacker must be authenticated with at least low-privilege access to the management interface - this is the primary limiting factor, meaning exploitation is not pre-auth. No user interaction is required (UI:N) and attack complexity is low (AC:L). Practical reach is further limited by whether the web interface is exposed to the attacker's network position (LAN by default; WAN only if remote management is enabled), so the realistic worst case is an internet-facing HG3 with weak or default credentials.

The signals are moderately aligned rather than screaming emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) shows a network-reachable, low-complexity attack requiring low privileges, with total technical impact (VC:H/VI:H/VA:H), scoring 7.4 (High). SSVC corroborates this: Exploitation=PoC, Automatable=no, Technical Impact=total - meaning working exploit code exists but it is not trivially wormable/mass-scannable. EPSS is only 0.29% (52nd percentile), consistent with the absence of KEV listing and suggesting no evidence of broad active exploitation yet. The key limiter is PR:L: the vector asserts the attacker must already hold some authenticated access to the web UI, which meaningfully reduces real-world risk versus a pre-auth RCE - but note this is high risk on internet-exposed devices still using default or weak credentials, a common failing on consumer gateways. Net: a genuine High-severity issue worth prompt patching, but not a drop-everything CISA-KEV-grade emergency based on current data.

An attacker who can reach the HG3 web interface and holds a low-privilege authenticated session (e.g. via default credentials on an internet-exposed device) sends a crafted request to /boaform/formTracert with shell metacharacters embedded in the datasize argument. The injected commands execute in the router's OS context, letting the attacker gain full control of the device, pivot into the internal network, or intercept traffic. A public proof-of-concept for this exact parameter has already been disclosed (VulDB / referenced exploit link), lowering the bar to reproduce.