CVE-2026-7096

🗓️ 27 Apr 2026 06:45:14Reported by VulDBType

cve🔗 web.nvd.nist.gov👁 13 Views🌐 WEB

Tenda HG3 flaw in formgponConf enables remote OS command injection via fmgpon_loid.

Reporter	Title	Published	Views	Family All 9
ATTACKERKB	CVE-2026-7096	27 Apr 202606:45	–	attackerkb
Circl	CVE-2026-7096	30 Apr 202617:07	–	circl
CNNVD	Tenda HG3 命令注入漏洞	27 Apr 202600:00	–	cnnvd
Cvelist	CVE-2026-7096 Tenda HG3 formgponConf os command injection	27 Apr 202606:45	–	cvelist
EUVD	EUVD-2026-25786	27 Apr 202606:45	–	euvd
NVD	CVE-2026-7096	27 Apr 202608:16	–	nvd
Positive Technologies	PT-2026-35365	27 Apr 202600:00	–	ptsecurity
RedhatCVE	CVE-2026-7096	5 Jun 202619:22	–	redhatcve
Vulnrichment	CVE-2026-7096 Tenda HG3 formgponConf os command injection	27 Apr 202606:45	–	vulnrichment

NVD

Node

tenda hg3_firmwareMatch300003070

AND

tenda hg3Match2.0

[
  {
    "vendor": "Tenda",
    "product": "HG3",
    "versions": [
      {
        "version": "2.0 300003070",
        "status": "affected"
      }
    ]
  }
]

Source	Link
vuldb	www.vuldb.com/vuln/359671/cti
tenda	www.tenda.com.cn/
vuldb	www.vuldb.com/submit/800796
notion	www.notion.so/Tenda-HG3-3250c75766a880c7b50fde0466557c5f
vuldb	www.vuldb.com/vuln/359671

Parameter	Position	Path	Description	CWE
fmgpon_loid	request body	/boaform/admin/formgponConf	OS command injection via parameter fmgpon_loid in formgponConf, enabling remote code execution.	CWE-77, CWE-78

17 Jun 2026 11:01Current

7.8High risk

Vulners AI Score7.8

CVSS 48.7

CVSS 3.18.8

CVSS 29

CVSS 38.8

EPSS0.04075

SSVC