What is the CVSS score of CVE-2026-25857?

CVE-2026-25857 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of G300 F Firmware are affected by CVE-2026-25857?

Tenda G300-F routers running firmware 16.01.14.2 and earlier are vulnerable to remote command execution through the WAN diagnostic feature, allowing unauthenticated attackers to gain full control of…

Is there a public PoC exploit available for CVE-2026-25857?

Yes, a public proof-of-concept exploit is available for CVE-2026-25857. Prioritise patching immediately. EPSS: 0.4%.

How to fix or mitigate CVE-2026-25857?

Within 24 hours: Identify all Tenda G300-F devices in production and isolate or restrict WAN diagnostic access via firewall rules. Within 7 days: Contact Tenda for firmware availability timeline and evaluate alternative router deployment for critical network segments. Within 30 days: Replace affected devices with patched firmware once available, or migrate to alternative vendor hardware if patch timeline is unacceptable.

G300 F Firmware CVE-2026-25857

HIGH

OS Command Injection (CWE-78)

2026-02-07 disclosure@vulncheck.com

Command Injection Tenda G300 F Firmware

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

PoC Detected

Mar 05, 2026 - 20:33 vuln.today

Public exploit code

CVE Published

Feb 07, 2026 - 22:16 nvd

HIGH 8.8

DescriptionCVE.org

Tenda G300-F router firmware version 16.01.14.2 and prior contain an OS command injection vulnerability in the WAN diagnostic functionality (formSetWanDiag). The implementation constructs a shell command that invokes curl and incorporates attacker-controlled input into the command line without adequate neutralization. As a result, a remote attacker with access to the affected management interface can inject additional shell syntax and execute arbitrary commands on the device with the privileges of the management process.

AnalysisAI

Unauthenticated command injection in Tenda G300-F router firmware version 16.01.14.2 and earlier allows authenticated attackers to execute arbitrary OS commands through the WAN diagnostic interface by injecting shell metacharacters into unvalidated curl parameters. An attacker with management interface access can exploit this to gain full system compromise with process-level privileges. Public exploit code exists and no patch is currently available.

Technical ContextAI

Classified as CWE-78 (OS Command Injection). Affects the WAN diagnostic component of G300-F Firmware. Tenda G300-F router firmware version 16.01.14.2 and prior contain an OS command injection vulnerability in the WAN diagnostic functionality (formSetWanDiag). The implementation constructs a shell command that invokes curl and incorporates attacker-controlled input into the command line without adequate neutralization. As a result, a remote attacker with access to the affected management interface can inject additional shell syntax and execute arbitrary commands on the device with the privileges