PT-2026-35533 · Tenda · Hg3

2Er00Ne · Published 2026-04-27 · Updated 2026-04-27 · CVE-2026-7160

Mitre

CVSS v3.1

8.8

High

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

A vulnerability was determined in Tenda HG3 2.0. This vulnerability affects the function formTracert of the file /boaform/formTracert. Executing a manipulation of the argument datasize can lead to command injection. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized.

Exploit

Fix

Command Injection

Special Elements Injection

Weakness Enumeration

CWE-77

CWE-74

Related Identifiers

CVE-2026-7160

Affected Products

Hg3

References · 8

• 🔥 https://notion.so/33e0c75766a880488924cf24523acf6c · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-7160 · Security Note
• https://vuldb.com/vuln/359759 · Note
• https://tenda.com.cn · Note
• https://vuldb.com/vuln/359759/cti · Note
• https://twitter.com/KaitanSecurity/status/2048892454166774244 · Twitter Post
• https://twitter.com/CVEnew/status/2048910089923510541 · Twitter Post
• https://vuldb.com/submit/802079 · Note