This vulnerability affects Tenda HG3 version 2.0 and involves an OS command injection via the 'countrystr' parameter in the /boaform/formCountrystr file. An attacker can remotely manipulate this parameter to execute arbitrary operating system commands on the device. The vulnerability has a CVSS 4.0 base score of 8.7, indicating high severity with network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability. The exploit is publicly available, increasing the risk of exploitation. No vendor-provided patch or official remediation level is documented at this time.

Successful exploitation allows remote attackers to execute arbitrary OS commands on the affected Tenda HG3 device, potentially leading to full compromise of the device's confidentiality, integrity, and availability. This could enable attackers to control the device, disrupt network operations, or use the device as a foothold for further attacks.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the device's management interface from untrusted networks and monitor for suspicious activity related to the /boaform/formCountrystr endpoint. Avoid exposing the device management interface directly to the internet.