Cyber Posture

CVE-2026-7160

HighPublic PoC

Published: 27 April 2026

Published
27 April 2026
Modified
30 April 2026
KEV Added
—
Patch
—
CVSS Score 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0097 76.7th percentile
Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Description

A vulnerability was determined in Tenda HG3 2.0. This vulnerability affects the function formTracert of the file /boaform/formTracert. Executing a manipulation of the argument datasize can lead to command injection. The attack may be performed from remote. The exploit has…

more

been publicly disclosed and may be utilized.

Mitigating Controls (NIST 800-53 r5)AI

SI-2 Flaw Remediation good match
prevent

Directly remediates the command injection vulnerability in the formTracert function by applying firmware patches or updates to the Tenda HG3 router.

SI-10 Information Input Validation good match
prevent

Prevents exploitation by implementing input validation and error handling for the datasize argument in the /boaform/formTracert file.

CM-7 Least Functionality partial match
prevent

Reduces attack surface by disabling or restricting the unnecessary tracert diagnostic function on the router.

Security SummaryAI

CVE-2026-7160 is a command injection vulnerability affecting Tenda HG3 2.0 routers, specifically in the formTracert function within the /boaform/formTracert file. The flaw occurs through manipulation of the datasize argument, enabling arbitrary command execution. Published on 2026-04-27, it carries a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and is associated with CWEs 74 and 77.

Remote attackers with low privileges can exploit this vulnerability without user interaction. Successful exploitation allows high-impact compromise of confidentiality, integrity, and availability, potentially leading to full device control via injected commands.

Advisories from VulDB indicate the exploit has been publicly disclosed and may be utilized by attackers. Practitioners should consult references including https://vuldb.com/vuln/359759, https://vuldb.com/submit/802079, and the vendor site at https://www.tenda.com.cn/ for any available patches or mitigation guidance.

Details

CWE(s)
CWE-74CWE-77

Affected Products

tenda
hg3 firmware
300003070

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1059.004 Unix Shell Execution
Adversaries may abuse Unix shell commands and scripts for execution.
attack.mitre.org →
Why these techniques?

Command injection in the web interface of the Tenda router enables exploitation of a public-facing application (T1190) and arbitrary Unix shell command execution (T1059.004).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References