Attack Chain

1. The attacker identifies a vulnerable Tenda HG3 2.0 router with an exposed web interface.
2. The attacker crafts a malicious HTTP request targeting the /boaform/formTracert endpoint.
3. The malicious request includes a manipulated datasize argument designed to inject a command.
4. The web server processes the request and passes the manipulated datasize argument to the formTracert function.
5. The formTracert function fails to properly sanitize the input, allowing the injected command to be executed by the system.
6. The injected command executes with the privileges of the web server process.
7. The attacker gains arbitrary code execution on the router.

Impact

Successful exploitation of this vulnerability allows a remote attacker to execute arbitrary commands on the Tenda HG3 2.0 router. This can lead to complete compromise of the device, including modification of router settings, interception of network traffic, and potential use of the router as a botnet node. Given the high base score of 8.8, this poses a significant risk to affected users.

Recommendation

• Apply available patches or firmware updates provided by Tenda to address CVE-2026-7160.
• Monitor web server logs for suspicious POST requests to /boaform/formTracert with unusual datasize parameters, as covered by the Sigma rule “Detect Tenda HG3 Command Injection Attempt”.
• Implement network intrusion detection system (IDS) rules to detect and block exploit attempts targeting this vulnerability.