CVE-2026-5339
MediumCVSS 4.7Exploitation Probability (EPSS)
Very high risk92th percentile - higher than 92% of all known CVEs
Summary
A command injection vulnerability was detected in Tenda G103 1.0.0.5 in the action_set_net_settings function of the gpon.lua file. Remote manipulation of arguments like authLoid leads to arbitrary command execution. The exploit is publicly available.
Risk Assessment
The organization risks remote takeover of the network device, potentially compromising network integrity and confidentiality.
Recommendation
Immediately update the Tenda G103 firmware to the latest version if available, or consider disconnecting the device from the network until a patch is released.
Original NVD description (English source)
A vulnerability was detected in Tenda G103 1.0.0.5. The impacted element is the function action_set_net_settings of the file gpon.lua of the component Setting Handler. Performing a manipulation of the argument authLoid/authLoidPassword/authPassword/authSerialNo/authType/oltType/usVlanId/usVlanPriority results in command injection. It is possible to initiate the attack remotely. The exploit is now public and may be used.