EUVD-2026-36752
GHSA-2p5w-f38x-fgff
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated command injection (PR:N/UI:N) executing as root gives total C/I/A; AV:N retained per reported vector though real reach is often LAN-only, which would lower it to AV:A.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
Tenda 5G03 V05.03.02.04 (Version 1.0) is vulnerable to Command injection in the function action_set_volume via the volume parameter.
AnalysisAI
OS command injection in the Tenda 5G03 5G CPE router (firmware V05.03.02.04) lets an attacker inject shell commands through the volume parameter of the action_set_volume handler, yielding full command execution on the device. Per the published CVSS vector the flaw is remotely reachable without authentication or user interaction, and publicly available exploit code exists (a proof-of-concept in the sezangel/IOT-vul research repository); it is not listed in CISA KEV and carries a modest EPSS of 0.45% (36th percentile), indicating no confirmed active exploitation yet. SSVC rates technical impact as total and the flaw as automatable, so successful exploitation gives complete control of the router.
Technical ContextAI
The Tenda 5G03 is a consumer/SMB 5G LTE CPE router whose web management/HTTP service exposes action handlers implemented in the device's httpd/CGI binary. The vulnerable function action_set_volume passes the attacker-supplied volume parameter into an OS command context (e.g. a system()/popen()-style call or shell string) without sanitization, the classic CWE-78 'Improper Neutralization of Special Elements used in an OS Command' pattern. Because embedded router firmware typically runs its web service and spawned commands as root on a BusyBox/Linux stack, injected metacharacters (;, |, `, &&) execute with the highest privilege on the device. Note the CPE string supplied (cpe:2.3:a:n/a:n/a:*) is a placeholder and does not actually identify the product; identification here rests on the description text and tags (Tenda, Command Injection).
RemediationAI
No vendor-released patch identified at time of analysis, so apply compensating controls. Restrict access to the router's HTTP management interface: disable any remote/WAN-side web management so the interface is not reachable from the internet, and limit LAN access to trusted administration hosts or a management VLAN - the trade-off is reduced remote administrability. Where feasible, block inbound access to the device's web-management port from untrusted networks at an upstream firewall, accepting that legitimate remote admin will also be blocked. Change default administrative credentials and monitor the device for unexpected outbound connections or process activity as an interim detection measure. Track the Tenda security portal and the CVE/EUVD records (https://nvd.nist.gov/vuln/detail/CVE-2026-38061) for a firmware update and upgrade to a fixed build once released; if this model is end-of-life, plan hardware replacement.
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Remote code execution in the Exim mail transfer agent (versions before 4.99.3) built against certain GnuTLS configuratio
SQL injection in EasyAppointments <=1.5.1 allows unauthenticated attackers to extract and modify database contents via t
Unauthenticated remote OS command injection in MeiG Smart FORGE_SLT711 cellular gateway firmware MDM9607.LE.1.0-00110-ST
Unauthenticated API access in LalanaChami Pharmacy Management System (commit 5c3d028) allows remote attackers to dump al
Privilege escalation via broken access control in Citrix Cloud (through 2025-11-10) lets a user holding only read-only p
go-wind-cms (GoWind) before 1.0.0 exposes all administrative APIs to any authenticated user because NewAuthorizer() retu
Giflib 5.2.2 contains a buffer overflow in the EGifGCBToExtension function that fails to validate allocated memory when
Denial of service in GPAC's MP4Box multimedia tool (versions before 26.02.0) arises from a use-after-free in the gf_sei_
Same weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today