What is the CVSS score of CVE-2026-38063?

CVE-2026-38063 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Tenda 5G03 are affected by CVE-2026-38063?

The Tenda 5G03 router (firmware V05.03.02.04) contains a critical remote command injection vulnerability (CVE-2026-38063, CVSS 9.8) allowing unauthenticated network attacks to gain arbitrary command…

How to fix or mitigate CVE-2026-38063?

Within 24 hours, inventory all Tenda 5G03 routers in production and identify units running firmware V05.03.02.04; isolate affected devices from production networks or implement emergency network segmentation to restrict access. Within 7 days, escalate to Tenda support to confirm patch availability and timeline, establish monitoring for exploitation attempts targeting the 'ia' parameter, and restrict administrative access via firewall rules limiting connections to known admin IPs only. Within 30 days, either apply any vendor-released patch immediately upon availability or execute a replacement plan for all vulnerable units with alternative 5G/LTE router solutions providing active security support.

Tenda 5G03 CVE-2026-38063

EUVD-2026-36754 CRITICAL

OS Command Injection (CWE-78)

2026-06-15 mitre

GHSA-235f-qxww-6764

Command Injection Tenda N A

9.8

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Unauthenticated command injection reachable over the network on a default endpoint yields PR:N/UI:N and full C/I/A on the device; AV:N reflects reachable web management interface.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 16:51 vuln.today

CVE Published

Jun 15, 2026 - 00:00 cve.org

CRITICAL 9.8

CVE Published

Jun 15, 2026 - 00:00 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Tenda 5G03 V05.03.02.04 (Version 1.0) is vulnerable to Command injection in the function action_radio_on_with_ia_apn via the ia parameter.

AnalysisAI

Command injection in the Tenda 5G03 5G/LTE router (firmware V05.03.02.04, hardware version 1.0) allows remote attackers to inject arbitrary OS commands through the 'ia' parameter processed by the action_radio_on_with_ia_apn function. The flaw carries a 9.8 CVSS and, per its CVSS vector, is network-reachable without authentication or user interaction, giving full command execution on the device. There is publicly available exploit code (a public PoC/write-up on GitHub), though EPSS remains modest at 0.45% and there is no evidence of active exploitation.

Technical ContextAI

The affected device is the Tenda 5G03, a small-office/home 5G CPE router. The root cause is CWE-78 (Improper Neutralization of Special Elements used in an OS Command), meaning the value supplied in the 'ia' (APN-related) parameter is passed into a shell/system call inside the action_radio_on_with_ia_apn handler without adequate sanitization, so shell metacharacters break out of the intended command and execute attacker-controlled commands. This is a classic embedded-router web/CGI backend injection where APN configuration input is concatenated into a command string. Note the CPE provided is a placeholder ('cpe:2.3:a:n/a:n/a:*') and does not properly identify the product; the actual affected item is the Tenda 5G03 firmware/hardware combination named in the description, not a generically-CPE'd application.

RemediationAI

No vendor-released patch identified at time of analysis - no fixed firmware version or Tenda security advisory is present in the provided data, so monitor Tenda's official support/download pages for a firmware update superseding V05.03.02.04 and apply it once released. As compensating controls until a patch exists: disable remote/WAN-side web management on the router so the vulnerable interface is not reachable from the Internet (trade-off: loss of remote administration convenience); restrict access to the router's HTTP management interface to a trusted management VLAN or specific admin hosts via firewall/ACL (trade-off: administrative overhead); and change default credentials and segment the router off untrusted LAN clients to reduce internal exposure. Because the injection is in the APN-related action_radio_on_with_ia_apn endpoint, blocking untrusted network access to the device's HTTP admin service is the most effective mitigation. Reference the technical details at https://github.com/sezangel/IOT-vul/tree/main/Tenda/5G03/action_radio_on_with_ia_apn and https://nvd.nist.gov/vuln/detail/CVE-2026-38063.