Description
A security flaw has been discovered in Tenda HG3 2.0 300003070. This vulnerability affects the function formgponConf of the file /boaform/admin/formgponConf. The manipulation of the argument fmgpon_loid results in os command injection. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Tenda | HG3 | 2.0 300003070 | — |
References
- VDB-359671 | Tenda HG3 formgponConf os command injection vdb-entry technical-description
- VDB-359671 | CTI Indicators (IOB, IOC, TTP, IOA) signature permissions-required
- Submit #800796 | Tenda HG3 N300 Wi-Fi xPON ONT HARD_VERSION=V2.0 , Version: 300003070 Remote code execution third-party-advisory
- https://www.notion.so/Tenda-HG3-3250c75766a880c7b50fde0466557c5f exploit
- https://www.tenda.com.cn/ product