CVE-2026-7119

HighCVSS 8.8/10Last modified Oct 26, 2026

Description

A vulnerability was detected in Tenda HG3 2.0. The impacted element is an unknown function of the file /boaform/formCountrystr. The manipulation of the argument countrystr results in os command injection. The attack may be performed from remote. The exploit is now public and may be used.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-77 CWE-78

Affected software

Vendor	Product	Versions
Tenda	HG3	2.0

References

https://vuldb.com/submit/800859Third Party Advisory, VDB Entry
https://vuldb.com/vuln/359719Third Party Advisory, VDB Entry
https://vuldb.com/vuln/359719/ctiPermissions Required, VDB Entry
https://www.notion.so/Tenda-HG3-1-33d0c75766a8808d8b38e9d090cec7abExploit, Third Party Advisory
https://www.tenda.com.cn/Product

Timeline

Published: Apr 27, 2026
Last modified: Oct 26, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-711908.7In OpenStack Swift through 2.38.0, the proxy server Accept header parser contains a regular expression vulnerable to catastrophic backtracki CVE-2026-711916.0In OpenStack Swift through 2.38.0, S3API middleware does not enforce that semantic x-amz-* headers are covered by the SigV4 signature on pre CVE-2026-711926.0In OpenStack Swift through 2.38.0, the S3API middleware does not sanitize Swift-native control headers (X-Copy-From, X-Copy-From-Account) fr CVE-2026-711939.6In OpenStack Designate before 22.0.1, zone creation checks (_is_subzone, _is_superzone, and the duplicate-zone DB constraint) are scoped to CVE-2026-711946.8In OpenStack Designate before 22.0.2, the mDNS handler performs pool-blind lookups when resolving record queries and NOTIFY requests. When t CVE-2026-711959.9In OpenStack Manila before 23.0.1, multiple Manila API operations on public shares do not verify that the caller owns the share. The API con CVE-2026-711987.0In OpenStack Glance before 32.0.1, the location API does not validate destination hosts when adding an HTTP location to an image. Unlike the CVE-2026-71205.3@fastify/static evaluates the allowedPath callback before normalizing dot segments and duplicate path separators in the pathname used for fi CVE-2026-712015.0In OpenStack Ironic through 38.0.0, a project reader that makes a crafted request to Ironic can return Portgroups assigned to Nodes owned or CVE-2026-712027.5The raster Rust crate's crop function (src/editor.rs) clamps the crop width/height against source dimensions but only clamps the offset_x/of CVE-2026-712035.3changedetection.io's REST API resources are protected by an @auth.check_token decorator validating the caller's x-api-key header, except the CVE-2026-712046.2changedetection.io's /settings save handler builds an update dict from form.data['application'] and blind-merges it into the stored applicat