This vulnerability affects Tenda HG3 version 2.0 300003070 and involves an OS command injection in the formgponConf function of the /boaform/admin/formgponConf endpoint. By manipulating the fmgpon_loid parameter, an attacker can inject and execute arbitrary operating system commands remotely. The CVSS 4.0 base score is 8.7, indicating a high severity with network attack vector, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No official patch or remediation level has been disclosed by the vendor, and the device is not a cloud service, so remediation depends on vendor action or user mitigation.

Successful exploitation allows remote attackers to execute arbitrary OS commands on the affected Tenda HG3 device, potentially leading to full compromise of the device's confidentiality, integrity, and availability. This can result in unauthorized control over the device and disruption of its normal operation. The vulnerability is exploitable remotely without authentication or user interaction, increasing the risk of widespread exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary mitigation has been published, users should monitor vendor communications for updates. Until a patch is available, restricting network access to the affected device's management interface and disabling remote administration features, if possible, may reduce exposure.