CVE-2026-5338
MediumCVSS 4.7Exploitation Probability (EPSS)
Very high risk92th percentile - higher than 92% of all known CVEs
Summary
In Tenda G103 1.0.0.5, the action_set_system_settings function in system.lua (Setting Handler component) does not neutralize the lanIp argument, leading to command injection. The attack can be performed remotely and the exploit has been publicly disclosed.
Risk Assessment
A remote attacker can execute arbitrary commands on the device, taking control of the router and network.
Recommendation
Restrict administrative access to the device and check for Tenda firmware updates.
Other vulnerabilities in Tenda G103
See all- CVE-2026-5339Medium
A command injection vulnerability was detected in Tenda G103 1.0.0.5 in the action_set_net_settings function of the gpon.lua file. Remote manipulation of arguments like authLoid leads to arbitrary command execution. The exploit is publicly available.
- CVE-2023-33530High
A command injection vulnerability exists in the Tenda G103 Gigabit GPON Terminal with firmware version V1.0.0.5. An attacker with web management privileges can inject commands and gain shell access.
Original NVD description (English source)
A security vulnerability has been detected in Tenda G103 1.0.0.5. The affected element is the function action_set_system_settings of the file system.lua of the component Setting Handler. Such manipulation of the argument lanIp leads to command injection. The attack may be performed from remote. The exploit has been disclosed publicly and may be used.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS