CVE-2026-7151: Tenda HG3 Buffer Overflow Vulnerability

CVE-2026-7151 Overview

CVE-2026-7151 is a stack-based buffer overflow vulnerability in the Tenda HG3 2.0 router. The flaw resides in the formUploadConfig function handling requests to /boaform/formIPv6Routing. Attackers can trigger the overflow by manipulating the destNet argument, corrupting stack memory on the device.

The vulnerability is exploitable over the network and a public exploit disclosure exists. Successful exploitation can compromise the confidentiality, integrity, and availability of the affected router. The weakness is classified under [CWE-119] for improper restriction of operations within memory buffers.

Critical Impact

Remote attackers with low-level credentials can corrupt stack memory in the HG3 web management interface, enabling potential code execution or denial of service against the router.

Affected Products

• Tenda HG3 router, hardware version 2.0
• Tenda HG3 firmware version 300003070
• Devices exposing the /boaform/formIPv6Routing endpoint

Discovery Timeline

• 2026-04-27 - CVE-2026-7151 published to NVD
• 2026-04-30 - Last updated in NVD database

Technical Details for CVE-2026-7151

Vulnerability Analysis

The Tenda HG3 router exposes a web management interface served by the boa HTTP daemon. Within this interface, the formUploadConfig handler processes IPv6 routing configuration submitted to /boaform/formIPv6Routing. The handler reads the destNet parameter from the HTTP request and writes it into a fixed-size stack buffer without enforcing bounds.

An authenticated attacker on the network can submit a crafted request with an oversized destNet value. The write overruns the buffer and overwrites adjacent stack data, including saved registers and the return address. The condition matches the [CWE-119] memory boundary violation pattern common to embedded router firmware.

The public disclosure increases the likelihood of exploitation tooling appearing in scanning frameworks. Although no in-the-wild exploitation is reported, internet-exposed administrative interfaces on consumer-grade routers are routinely targeted by botnets.

Root Cause

The root cause is the absence of length validation on the destNet parameter before it is copied into a local stack buffer. Functions such as strcpy or sprintf in the firmware copy attacker-controlled input directly into the fixed buffer, allowing the stack frame to be corrupted.

Attack Vector

The attack vector is network-based and requires low-privilege access to the router's web interface. An attacker sends an HTTP POST request to /boaform/formIPv6Routing containing an overlong destNet argument. Depending on firmware protections, the overflow can cause the boa process to crash or hijack execution flow on the MIPS or ARM processor of the device.

No verified proof-of-concept code is published in a structured repository. The vulnerability mechanism is described in the VulDB advisory referenced in the VulDB #359750 entry.

Detection Methods for CVE-2026-7151

Indicators of Compromise

• HTTP POST requests to /boaform/formIPv6Routing containing abnormally long destNet parameter values
• Unexpected restarts or crashes of the boa web server process on Tenda HG3 devices
• Outbound connections from the router to unknown command-and-control infrastructure following inbound traffic to the admin interface
• Configuration changes to IPv6 routing tables not initiated by administrators

Detection Strategies

• Inspect web access logs from the router or upstream proxies for POST requests targeting /boaform/formIPv6Routing with parameter values exceeding typical IPv6 prefix length
• Deploy network intrusion detection signatures matching oversized destNet form fields in HTTP traffic to router management ports
• Monitor for repeated authentication attempts followed by malformed administrative requests against router IP addresses

Monitoring Recommendations

• Forward router syslog output to a centralized log platform for correlation with network telemetry
• Alert on any management interface access originating from untrusted network segments or external addresses
• Track firmware version reporting to identify HG3 devices still running version 300003070

How to Mitigate CVE-2026-7151

Immediate Actions Required

• Restrict access to the router web management interface to trusted internal management subnets only
• Disable remote WAN-side administration on all Tenda HG3 devices if enabled
• Rotate administrative credentials on affected devices to prevent reuse of compromised low-privilege accounts
• Inventory all Tenda HG3 hardware and firmware version 300003070 deployments

Patch Information

No vendor patch is referenced in the published advisory at the time of NVD publication. Consult the Tenda Security Page for firmware updates addressing CVE-2026-7151. The advisory details are available in the VulDB #359750 entry.

Workarounds

• Place affected routers behind a network firewall that blocks inbound traffic to the management port from untrusted networks
• Apply access control lists limiting HTTP and HTTPS administrative access to specific source addresses
• Replace end-of-life or unmaintained Tenda HG3 devices with currently supported hardware if no patch becomes available
• Segment IoT and router management traffic onto a dedicated VLAN with strict egress filtering