CVE-2026-7096
Published: 27 April 2026
Summary
CVE-2026-7096 is a high-severity Command Injection (CWE-77) vulnerability in Tenda Hg3 Firmware. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 23.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly validates the fmgpon_loid input argument in the formgponConf function to prevent OS command injection exploits.
Enables timely identification, reporting, and patching of the specific OS command injection flaw in Tenda HG3 2.0 firmware version 300003070.
Restricts the fmgpon_loid input to valid formats and lengths, blocking malicious OS command payloads in the vulnerable /boaform/admin/formgponConf endpoint.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CVE enables exploitation of public-facing web application (T1190) via command injection in router firmware, directly facilitating arbitrary Unix shell command execution (T1059.004).
NVD Description
A security flaw has been discovered in Tenda HG3 2.0 300003070. This vulnerability affects the function formgponConf of the file /boaform/admin/formgponConf. The manipulation of the argument fmgpon_loid results in os command injection. It is possible to launch the attack remotely.…
more
The exploit has been released to the public and may be used for attacks.
Deeper analysisAI
CVE-2026-7096 is an OS command injection vulnerability (CWE-77, CWE-78) affecting Tenda HG3 2.0 router firmware version 300003070. The flaw exists in the formgponConf function of the /boaform/admin/formgponConf file, where manipulation of the fmgpon_loid argument enables attackers to inject operating system commands. Published on 2026-04-27, it carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
The vulnerability is exploitable remotely by low-privileged users over the network with low attack complexity and no user interaction required. Successful exploitation allows arbitrary OS command execution, resulting in high impacts to confidentiality, integrity, and availability, potentially leading to full device compromise.
Advisories on VulDB (including submit/800796, vuln/359671, and vuln/359671/cti) document the issue and confirm a public exploit release that may be used in attacks. Further details appear on a Notion page specific to Tenda HG3 and the vendor's website at tenda.com.cn, though explicit patch or mitigation instructions are not detailed in the disclosure.
The public availability of the exploit heightens risk for unpatched Tenda HG3 2.0 devices.
Details
- CWE(s)