Tenda HG3 Command Injection Vulnerability Allowing Remote Code Execution

A command injection vulnerability has been identified in the Tenda HG3 router operating system version 2.0. This issue arises in the 'formTracert' function of the '/boaform/formTracert' file, where improper validation of the 'datasize' argument allows for unauthorized command execution. The vulnerability can be exploited remotely, potentially leading to unauthorized access and control over the device, causing abnormal operations and significant security risks.

Impact

Exploitation of this vulnerability allows for command injection, with the potential for remote code execution on the affected device.