CVE-2026-7096: Tenda HG3 OS Command Injection Vulnerability

CVE-2026-7096 Overview

A critical OS command injection vulnerability has been discovered in the Tenda HG3 router firmware version 2.0 300003070. This vulnerability affects the formgponConf function located in the /boaform/admin/formgponConf file. By manipulating the fmgpon_loid argument, an authenticated attacker can inject arbitrary operating system commands that will be executed on the underlying device. The attack can be launched remotely over the network, making this vulnerability particularly dangerous for exposed devices.

Critical Impact

Remote attackers with low privileges can achieve full system compromise through OS command injection, potentially gaining complete control over the affected Tenda HG3 router and any connected network infrastructure.

Affected Products

• Tenda HG3 Firmware Version 2.0 300003070

Discovery Timeline

• 2026-04-27 - CVE-2026-7096 published to NVD
• 2026-04-27 - Last updated in NVD database

Technical Details for CVE-2026-7096

Vulnerability Analysis

This vulnerability is classified as CWE-77 (Improper Neutralization of Special Elements used in a Command). The affected function formgponConf fails to properly sanitize user-supplied input in the fmgpon_loid parameter before incorporating it into system commands. This allows attackers to break out of the intended command context and execute arbitrary commands with the privileges of the web server process, which typically runs with elevated permissions on embedded devices.

The attack requires network access to the device's administration interface and basic authentication. Once authenticated, an attacker can craft malicious requests containing shell metacharacters or command separators within the fmgpon_loid parameter. These injected commands are then executed by the underlying operating system without proper validation.

Root Cause

The root cause of this vulnerability is insufficient input validation and sanitization within the formgponConf function. The fmgpon_loid parameter is directly concatenated into a system command string without proper escaping or filtering of shell metacharacters such as semicolons, pipes, backticks, or other command separators. This design flaw allows user-controlled input to influence the execution flow of system-level commands.

Attack Vector

The attack is network-based and can be performed remotely against any exposed Tenda HG3 device running the vulnerable firmware. An attacker with valid credentials (or access to a session) can send a specially crafted HTTP request to the /boaform/admin/formgponConf endpoint. By including OS commands within the fmgpon_loid parameter value, the attacker can execute arbitrary commands on the device.

The exploitation typically involves injecting command separators followed by malicious commands. For example, an attacker might append shell commands using characters like ;, |, ||, &&, or backticks to escape the intended command context. The public availability of exploit details increases the risk of widespread exploitation against vulnerable devices.

For technical details about this vulnerability, refer to the VulDB entry and the Notion Security Overview.

Detection Methods for CVE-2026-7096

Indicators of Compromise

• Unusual HTTP POST requests to /boaform/admin/formgponConf containing shell metacharacters (;, |, &&, backticks) in the fmgpon_loid parameter
• Unexpected outbound network connections from the router to external IP addresses
• Presence of unauthorized files or scripts in the device filesystem
• Abnormal process spawning from the web server process on the device

Detection Strategies

• Implement network monitoring to detect suspicious HTTP traffic patterns targeting the /boaform/admin/formgponConf endpoint
• Deploy intrusion detection system (IDS) rules to identify command injection patterns in HTTP request parameters
• Monitor for anomalous outbound connections from network devices that may indicate successful compromise
• Review authentication logs for unauthorized access attempts to the router's administration interface

Monitoring Recommendations

• Enable logging on the Tenda HG3 device if available and regularly review logs for suspicious activity
• Implement network segmentation to isolate IoT and network devices from critical infrastructure
• Use network traffic analysis tools to baseline normal router behavior and alert on deviations
• Consider deploying a web application firewall (WAF) in front of exposed management interfaces

How to Mitigate CVE-2026-7096

Immediate Actions Required

• Restrict access to the device administration interface to trusted networks only using firewall rules or ACLs
• Disable remote administration access if not required for operational purposes
• Ensure strong, unique credentials are configured for administrative access
• Monitor for firmware updates from Tenda and apply patches immediately when available
• Consider replacing the device with a supported model if no patch is forthcoming

Patch Information

At the time of publication, no official patch has been confirmed from Tenda. Organizations should monitor the Tenda Official Site for security advisories and firmware updates. Given the public disclosure of this vulnerability and availability of exploit information, immediate mitigating actions should be taken while awaiting an official fix.

Workarounds

• Implement network access controls to restrict management interface access to trusted IP addresses only
• Place the device behind a firewall that filters requests containing suspicious characters in HTTP parameters
• Disable the GPON configuration functionality if not required for normal operation
• Enable strong authentication and consider implementing additional access controls such as VPN-only management access

# Example firewall rule to restrict admin interface access (iptables)
# Allow only trusted management network to access the web interface
iptables -A INPUT -p tcp --dport 80 -s 192.168.1.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -s 192.168.1.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP