CVE-2026-7160
Published: 27 April 2026
Summary
CVE-2026-7160 is a high-severity Injection (CWE-74) vulnerability in Tenda Hg3 Firmware. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 23.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly remediates the command injection vulnerability in the formTracert function by applying firmware patches or updates to the Tenda HG3 router.
Prevents exploitation by implementing input validation and error handling for the datasize argument in the /boaform/formTracert file.
Reduces attack surface by disabling or restricting the unnecessary tracert diagnostic function on the router.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Command injection in the web interface of the Tenda router enables exploitation of a public-facing application (T1190) and arbitrary Unix shell command execution (T1059.004).
NVD Description
A vulnerability was determined in Tenda HG3 2.0. This vulnerability affects the function formTracert of the file /boaform/formTracert. Executing a manipulation of the argument datasize can lead to command injection. The attack may be performed from remote. The exploit has…
more
been publicly disclosed and may be utilized.
Deeper analysisAI
CVE-2026-7160 is a command injection vulnerability affecting Tenda HG3 2.0 routers, specifically in the formTracert function within the /boaform/formTracert file. The flaw occurs through manipulation of the datasize argument, enabling arbitrary command execution. Published on 2026-04-27, it carries a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and is associated with CWEs 74 and 77.
Remote attackers with low privileges can exploit this vulnerability without user interaction. Successful exploitation allows high-impact compromise of confidentiality, integrity, and availability, potentially leading to full device control via injected commands.
Advisories from VulDB indicate the exploit has been publicly disclosed and may be utilized by attackers. Practitioners should consult references including https://vuldb.com/vuln/359759, https://vuldb.com/submit/802079, and the vendor site at https://www.tenda.com.cn/ for any available patches or mitigation guidance.
Details
- CWE(s)