Tenda 5G03 CVE-2026-38061

Exploitation requires the attacker to reach the Tenda 5G03's HTTP management service and invoke the action_set_volume action with a malicious volume parameter; the specific prerequisite is network reachability of the device web interface. Per the CVSS vector (PR:N/UI:N) no authentication or user interaction is required. The key LIMITING factor is exposure: the management interface is normally LAN-bound, so remote (WAN) exploitation depends on the non-default condition that remote web management is enabled or the port is otherwise forwarded/exposed; on default deployments an attacker must be on the local network. Exploitation is also constrained to the named firmware build V05.03.02.04.

Signals partly conflict and warrant judgment. The CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N, all impacts High) and SSVC (Automatable: yes, Technical Impact: total) argue for high priority, and OS command injection with root-level execution is a genuinely severe outcome. However, SSVC exploitation status is 'none', the CVE is NOT in CISA KEV, and EPSS is low at 0.45% (36th percentile), so there is no evidence of widespread real-world exploitation despite a POC existing. The most important caveat is attack vector: AV:N assumes the router's management interface is remotely reachable, but such Tenda web handlers are normally bound to the LAN, so true internet-facing exploitation depends on WAN-side management being exposed - a common misconfiguration but not the default. Net: treat as a high-priority patch for exposed or LAN-accessible devices, but the low EPSS and 'exploitation: none' status suggest opportunistic/targeted rather than mass exploitation today.

An attacker with reachability to the router's web management interface (e.g. from the LAN, or from the internet if remote management is exposed) sends a crafted request to the action_set_volume endpoint with shell metacharacters embedded in the volume parameter, such as a value containing ';' followed by an arbitrary command. The injected command runs with the web server's privileges (typically root), giving full device takeover; a proof-of-concept for this exact handler is published in the sezangel/IOT-vul repository.