CVE-2026-7119
HIGHCVSS 8.8/10EPSS 3.27%
Last modified
CVE-2026-7119 is a high-severity vulnerability rated 8.8/10 on the CVSS scale. A vulnerability was detected in Tenda HG3 2.0. The impacted element is an unknown function of the file /boaform/formCountrystr. EPSS estimates a 3.27% chance of exploitation in the next 30 days.
Description
A vulnerability was detected in Tenda HG3 2.0. The impacted element is an unknown function of the file /boaform/formCountrystr. The manipulation of the argument countrystr results in os command injection. The attack may be performed from remote. The exploit is now public and may be used.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Tenda | Hg3 Firmware | 300003070 |
References
- https://vuldb.com/submit/800859Third Party Advisory, VDB Entry
- https://vuldb.com/vuln/359719Third Party Advisory, VDB Entry
- https://vuldb.com/vuln/359719/ctiPermissions Required, VDB Entry
- https://www.notion.so/Tenda-HG3-1-33d0c75766a8808d8b38e9d090cec7abExploit, Third Party Advisory
- https://www.tenda.com.cn/Product
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2026-7119?
A vulnerability was detected in Tenda HG3 2.0. The impacted element is an unknown function of the file /boaform/formCountrystr. The manipulation of the argument countrystr results in os command injection. The attack may be performed from remote. The exploit is now public and may be used.
How severe is CVE-2026-7119?
CVE-2026-7119 has a CVSS score of 8.8/10 (HIGH severity). The EPSS model estimates a 3.27% probability of exploitation in the next 30 days.
How do I fix CVE-2026-7119?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-71181Dell Update Package Framework, versions prior to 26.07.03, c…6
- CVE-2026-71182Dell Update Package Framework, versions prior to 26.07.03, c…6
- CVE-2026-71183An authorization vulnerability in Apache DolphinScheduler al…7.1
- CVE-2026-71184Gitea's pull request review notifier does not attach the pul…8.8
- CVE-2026-71187The Ebyte device relies on client side authentication logic …9.8
- CVE-2026-71189An attacker can construct a request that, if issued by anoth…3.5
- CVE-2026-71190In OpenStack Swift through 2.38.0, the proxy server Accept h…8.7
- CVE-2026-71191In OpenStack Swift through 2.38.0, S3API middleware does not…6
- CVE-2026-71192In OpenStack Swift through 2.38.0, the S3API middleware does…6
- CVE-2026-71193In OpenStack Designate before 22.0.1, zone creation checks (…9.6
- CVE-2026-71194In OpenStack Designate before 22.0.2, the mDNS handler perfo…6.8
- CVE-2026-71195In OpenStack Manila before 23.0.1, multiple Manila API opera…9.9
Are you affected by CVE-2026-7119?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST