The vulnerability CVE-2026-7151 affects Tenda HG3 version 2.0 and involves a stack-based buffer overflow in the formUploadConfig function of the /boaform/formIPv6Routing endpoint. By manipulating the destNet argument, an attacker can cause a buffer overflow condition remotely. The CVSS 4.0 score is 8.7, reflecting high impact and ease of exploitation (network attack vector, low complexity, no privileges or user interaction required). The vulnerability state is published, but no remediation level or patch information is available from the vendor. The exploit has been publicly disclosed but is not known to be exploited in the wild.

Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code or cause a denial of service on affected Tenda HG3 devices. Given the buffer overflow nature and remote attack vector, the impact is considered high, potentially compromising device integrity and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting network access to the vulnerable endpoint or deploying network-level protections to limit exposure. Monitor vendor communications for updates on patches or official mitigations.