A critical OS command injection vulnerability in Tenda HG3 routers enables remote attackers to execute unauthorized commands, posing a severe risk of full system compromise.

The vulnerability is an OS command injection flaw (CWE-78) triggered by improper validation of the countrystr argument within the /boaform/formCountrystr function. The CVSS vector (PR:L) indicates that the attacker must possess low-level privileges to successfully interact with the vulnerable endpoint.

The ability to perform OS command injection grants an attacker the power to execute arbitrary code with the privileges of the web server. This could lead to a complete takeover of the affected networking device, resulting in unauthorized network access, data exfiltration, or the use of the device as a pivot point for further attacks on the internal network. With a CVSS score of 8.8, this flaw represents a high-severity risk that could lead to significant operational disruption and security breaches.

Immediate Action: Since no specific patch version is currently identified, users should restrict administrative access to the affected device management interface and disable remote access features.

Proactive Monitoring: Security teams should monitor network traffic for suspicious requests targeting the /boaform/formCountrystr endpoint and review system logs for unauthorized command execution patterns.

Compensating Controls: Implement a Web Application Firewall (WAF) or equivalent network filtering rules to block or sanitize malicious input directed at the identified vulnerable endpoint.

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the technical write-up provided by the reference.

Given the severity of this command injection vulnerability and the availability of public proof-of-concept material, immediate defensive action is required. Organizations utilizing Tenda HG3 devices should isolate these systems from the public internet and apply vendor-provided updates as soon as they become available to mitigate the risk of remote code execution.