CVE-2026-7096: Tenda HG3 Router OS Command Injection
The National Vulnerability Database (NVD) reports a high-severity OS command injection vulnerability, CVE-2026-7096, in Tenda HG3 2.0 300003070 routers. This flaw resides within the formgponConf function of the /boaform/admin/formgponConf file. Attackers can exploit this remotely by manipulating the fmgpon_loid argument.
This is a critical issue. An OS command injection allows an attacker to execute arbitrary commands on the underlying operating system with the privileges of the vulnerable application. Given that the exploit has been publicly released, this vulnerability is now in the wild, enabling immediate remote attacks against unpatched devices. Attackers can leverage this for full device compromise, network pivot, or to establish persistent access.
CISOs and network defenders must understand the implications: an exposed router with this vulnerability is an open door. The ease of exploitation, combined with public exploit code, means mass exploitation is highly probable. Organizations with these devices in their perimeter or internal networks face significant risk.
What This Means For You
- If your organization uses Tenda HG3 2.0 300003070 routers, this is an immediate threat. Given the public exploit and remote attack vector, assume compromise is imminent if unpatched. Prioritize patching or isolating these devices immediately. Audit network logs for unusual activity originating from or targeting these routers.
Related ATT&CK Techniques
🛡️ Detection Rules
2 rules · 6 SIEM formats2 detection rules auto-generated for this incident, mapped to MITRE ATT&CK. Sigma YAML is free — export to any SIEM format via the Intel Bot.
CVE-2026-7096: Tenda HG3 OS Command Injection via formgponConf
title: CVE-2026-7096: Tenda HG3 OS Command Injection via formgponConf
id: scw-2026-04-27-ai-1
status: experimental
level: critical
description: |
Detects attempts to exploit CVE-2026-7096 by targeting the formgponConf function in Tenda HG3 routers. The rule looks for requests to '/boaform/admin/formgponConf' with the 'fmgpon_loid' parameter containing command injection characters like ';', '`', '|', '&&', or '||'. This is a direct indicator of the exploit being used for initial access.
author: SCW Feed Engine (AI-generated)
date: 2026-04-27
references:
- https://shimiscyberworld.com/posts/nvd-CVE-2026-7096/
tags:
- attack.initial_access
- attack.t1190
logsource:
category: webserver
detection:
selection:
cs-uri|contains:
- '/boaform/admin/formgponConf'
cs-uri-query|contains:
- 'fmgpon_loid='
cs-uri-query|contains:
- ';'
cs-uri-query|contains:
- '`'
cs-uri-query|contains:
- '|'
cs-uri-query|contains:
- '&&'
cs-uri-query|contains:
- '||'
condition: selection
falsepositives:
- Legitimate administrative activity
Source: Shimi's Cyber World · License & reuse
Indicators of Compromise
| ID | Type | Indicator |
|---|---|---|
| CVE-2026-7096 | Command Injection | Tenda HG3 2.0 300003070 |
| CVE-2026-7096 | Command Injection | Vulnerable function: formgponConf in /boaform/admin/formgponConf |
| CVE-2026-7096 | Command Injection | Vulnerable argument: fmgpon_loid |
Written by SCW Vulnerability Desk
Source & Attribution
| Source Platform | NVD |
| Channel | National Vulnerability Database |
| Published | April 27, 2026 at 11:16 UTC |
This content was AI-rewritten and enriched by Shimi's Cyber World based on the original source. All intellectual property rights remain with the original author.
Believe this infringes your rights? Submit a takedown request.
Related coverage
CVE-2026-7108 — Code-Projects Invoice System In Laravel Vulnerability
CVE-2026-7108 — A security vulnerability has been detected in code-projects Invoice System in Laravel 1.0. This affects an unknown function. Such manipulation leads to cross-site...
CVE-2026-7107 — Unrestricted File Upload
CVE-2026-7107 — A weakness has been identified in code-projects Invoice System in Laravel 1.0. The impacted element is an unknown function of the file /company....
CVE-2026-7102 — Tenda F456 Command Injection
CVE-2026-7102 — A vulnerability was found in Tenda F456 1.0.0.5. This impacts the function FromWriteFacMac of the file /goform/WriteFacMac of the component httpd. The manipulation...