CVE-2026-7119: Tenda HG3 Command Injection Vulnerability

CVE-2026-7119 Overview

A critical OS command injection vulnerability has been identified in Tenda HG3 2.0 routers. The vulnerability exists in the /boaform/formCountrystr endpoint, where improper sanitization of the countrystr argument allows attackers to inject and execute arbitrary operating system commands. This network-accessible vulnerability can be exploited remotely by authenticated users to gain unauthorized control over the affected device.

Critical Impact

Remote attackers with low-level authentication can inject arbitrary OS commands through the countrystr parameter, potentially leading to complete device compromise, data exfiltration, and network lateral movement.

Affected Products

• Tenda HG3 version 2.0

Discovery Timeline

• 2026-04-27 - CVE-2026-7119 published to NVD
• 2026-04-27 - Last updated in NVD database

Technical Details for CVE-2026-7119

Vulnerability Analysis

This vulnerability represents a classic OS command injection flaw (CWE-77) in the Tenda HG3 router's web management interface. The affected endpoint /boaform/formCountrystr fails to properly validate and sanitize user-supplied input in the countrystr parameter before incorporating it into system command execution. When an attacker submits a crafted request containing shell metacharacters or command separators, these are passed directly to the underlying operating system shell, allowing arbitrary command execution in the context of the web server process (typically running with elevated privileges on embedded devices).

The vulnerability is accessible over the network and requires only low-level privileges to exploit, making it a significant risk for organizations using these devices. The exploit has been publicly disclosed, increasing the likelihood of active exploitation attempts in the wild.

Root Cause

The root cause of CVE-2026-7119 is insufficient input validation and improper neutralization of special elements used in OS commands. The vulnerable function in the /boaform/formCountrystr handler directly incorporates user-controlled input from the countrystr parameter into a system command without proper sanitization or escaping. This violates secure coding practices for handling user input in command execution contexts.

Embedded devices like routers often run with limited security controls, and the web management interface typically executes with root or administrative privileges, amplifying the impact of such vulnerabilities.

Attack Vector

The attack is network-based and can be performed remotely against any Tenda HG3 2.0 device with an accessible web management interface. An attacker with valid low-privilege credentials can craft a malicious HTTP request to the /boaform/formCountrystr endpoint, embedding OS commands within the countrystr parameter.

The attack methodology involves injecting shell command separators (such as ;, |, or &&) followed by arbitrary commands into the parameter value. When the vulnerable code processes this input, it executes both the intended operation and the injected malicious commands. Successful exploitation grants the attacker the ability to execute commands with the privileges of the web server process, which on embedded devices typically means full system control.

Technical details and proof-of-concept information can be found in the VulDB Vulnerability Report and Notion Documentation.

Detection Methods for CVE-2026-7119

Indicators of Compromise

• Unusual HTTP POST requests to /boaform/formCountrystr containing shell metacharacters (;, |, &&, `, $()) in the countrystr parameter
• Unexpected outbound network connections from the router to external hosts
• Presence of unauthorized user accounts or modified system configurations on the device
• Anomalous process execution or new services running on the router

Detection Strategies

• Deploy network intrusion detection rules to identify HTTP requests to /boaform/formCountrystr containing command injection patterns
• Monitor router logs for unusual authentication attempts and administrative actions
• Implement web application firewall (WAF) rules to block requests with OS command injection payloads targeting the affected endpoint
• Use SentinelOne Singularity to monitor network traffic for exploitation attempts against IoT and embedded devices

Monitoring Recommendations

• Enable verbose logging on the Tenda HG3 device if available
• Monitor network traffic to and from the router's management interface for anomalous patterns
• Implement network segmentation to isolate router management interfaces from untrusted networks

How to Mitigate CVE-2026-7119

Immediate Actions Required

• Restrict access to the router's web management interface to trusted IP addresses only
• Disable remote management access if not required for operations
• Place the router behind a firewall that filters access to the management interface
• Review device logs for any signs of prior exploitation attempts

Patch Information

At the time of publication, no official security patch has been released by Tenda for this vulnerability. Organizations should monitor the Tenda Official Website for firmware updates and apply patches immediately when available.

SentinelOne customers benefit from proactive threat detection capabilities that can identify exploitation attempts targeting this vulnerability. The SentinelOne Singularity platform provides network visibility and behavioral analysis to detect command injection attacks against IoT and embedded devices.

Workarounds

• Implement network-level access controls to restrict management interface access to authorized administrators only
• Use a VPN or jump host to access the router's management interface instead of exposing it directly
• Consider replacing affected devices with alternative solutions if patches are not made available
• Monitor for vendor security advisories through VulDB for updates on this vulnerability

# Example: Restrict management interface access using iptables on a gateway device
iptables -A FORWARD -d <router_ip> -p tcp --dport 80 -j DROP
iptables -A FORWARD -s <trusted_admin_ip> -d <router_ip> -p tcp --dport 80 -j ACCEPT