A remote command injection vulnerability (CVE-2026-7119) has been discovered in Tenda HG3 2.0 routers. The vulnerability affects the /boaform/formCountrystr file where manipulation of the countrystr argument allows attackers to execute OS commands remotely. The exploit is publicly available, making this a critical security concern for affected devices. Organizations using Tenda HG3 routers should prioritize patching or implementing mitigations immediately.