EUVD-2026-36755
GHSA-h25f-jcx9-5wp6
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach 5G03 management interface
-
DeliveryCraft dialNumber with shell metacharacters
-
ExploitPOST to action_dial_call handler
-
ExecutionShell executes injected command as root
-
PersistInstall backdoor / persist
-
ImpactPivot into LAN
Vulnerability Assessment
| Weakness |
CWE
MITRE ATT&CK
2 techniques across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network reachability to the Tenda 5G03 web-management service and the ability to invoke the action_dial_call function with a controlled dialNumber parameter; the payload is delivered as shell metacharacters within that parameter, which the firmware passes to an OS shell. Per the reported CVSS vector (PR:N/UI:N) no authentication or user interaction is claimed, but a real limiting factor is exposure: these Tenda action_* endpoints are typically bound to the LAN/management interface, so Internet-facing exploitation depends on remote management (WAN admin) being enabled - otherwise an attacker must be LAN-adjacent. Exploitation is also constrained to the specific model/firmware Tenda 5G03 V05.03.02.04 (Version 1.0); whether web-login authentication is actually enforced on this endpoint is not confirmed from the provided data and should be verified. |
| Impact | Signals are mixed. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H = 9.8 Critical) and SSVC (Automatable: yes, Technical Impact: total) both point to a trivially exploitable, high-consequence RCE, and a POC exists - which normally elevates priority. However, SSVC records Exploitation: 'none' (no observed exploitation), the flaw is not in CISA KEV, and EPSS is only 0.45% (36th percentile), so real-world exploitation is currently unproven and likely opportunistic/targeted rather than mass-scanned. A key caveat: for Tenda CPE devices these action_* endpoints are normally exposed on the LAN/management interface, so the practical attack vector is frequently LAN-adjacent rather than fully Internet-facing unless remote management is enabled - the PR:N/AV:N rating should be verified against actual network exposure. Net assessment: genuinely high technical severity with a working POC, but current spread appears low; prioritize for exposed/Internet-facing 5G03 units, treat LAN-only units as important-but-not-emergency. |
| Exploit ScenarioDerived | An attacker with reachability to the Tenda 5G03 management interface sends a crafted request to the action_dial_call handler with a dialNumber value containing shell metacharacters (e.g. a number followed by ';telnetd -l /bin/sh -p 4444'). The unsanitized value is executed by the device's shell as root, giving the attacker full command execution to install a backdoor, capture traffic, or pivot into the LAN. Public POC code for this exact endpoint is available, lowering the skill required; given AC:L and PR:N in the reported vector, exploitation is low-complexity where the endpoint is reachable. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 23, 2026
OS command injection in the Tenda 5G03 5G router (firmware V05.03.02.04, hardware version 1.0) lets attackers inject arbitrary shell commands through the unsanitized dialNumber parameter of the action_dial_call handler. The reported CVSS 3.1 vector rates it 9.8 (network, no privileges, no user interaction) with total technical impact, and publicly available exploit code exists in the sezangel/IOT-vul repository, though there is no public exploit identified as weaponized and no CISA KEV listing. EPSS is modest at 0.45% (36th percentile), indicating the flaw is disclosed with a POC but not yet showing broad exploitation activity.
RemediationAI
No vendor-released patch identified at time of analysis - the only referenced material is a proof-of-concept, not a fixed firmware build, so monitor Tenda's support/download portal for a firmware release superseding V05.03.02.04 and apply it once published. As compensating controls until a patched firmware exists: disable remote/WAN web management so the action_dial_call endpoint is not reachable from the Internet (side effect: administrators lose off-LAN management); restrict access to the router's HTTP management interface to a trusted management VLAN or specific admin IPs via firewall/ACL (side effect: breaks management from other network segments); place the device behind an upstream firewall that blocks inbound access to its management port; and change default credentials and segment the CPE away from sensitive assets to limit blast radius if compromised. Track the POC repository (https://github.com/sezangel/IOT-vul/tree/main/Tenda/5G03/action_dial_call) and the NVD entry for updates.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is the web/management backend of a Tenda 5G03 5G CPE router, specifically the action_dial_call function that initiates a cellular dial operation. This is a classic CWE-78 (Improper Neutralization of Special Elements used in an OS Command) flaw: the dialNumber value supplied by the client is passed into a system shell call (typically via system()/popen() or an equivalent on the embedded Linux firmware) without sanitization, so shell metacharacters (;, |, &&, backticks, $()) are interpreted as commands. Embedded SOHO/CPE devices like this run their web handlers as root, so injected commands generally execute with the highest privilege. The CPE string provided (cpe:2.3:a:n/a:n/a:*) is a placeholder with no meaningful vendor/product/version tokens, so exact affected-product enumeration must come from the description rather than the CPE feed.
Know when N A gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unsanitized parameter to a shell handler yields low-complexity root RCE with no auth per reported vector; AV:N retained though real exposure is often LAN-adjacent.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
2DescriptionCVE.org
Tenda 5G03 V05.03.02.04 (Version 1.0) is vulnerable to Command injection in the function action_dial_call via the dialNumber parameter.
Executive ViewAI
The Tenda 5G03 5G router (firmware V05.03.02.04) contains a critical unauthenticated remote code execution vulnerability, and publicly available exploit code exists. Organizations relying on these routers face immediate risk of complete infrastructure compromise, enabling attackers to disable connectivity, intercept traffic, or establish persistence for lateral movement into corporate systems.
No vendor-released patch identified at time of analysis. Interim mitigations include: network segmentation isolating affected routers from critical systems, firewall rules restricting access to management interfaces and dialNumber endpoint, intrusion detection signatures for dialNumber injection patterns, comprehensive access logging and command execution monitoring, and temporary rerouting of critical traffic through alternative connectivity if available.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Exploit-DB