EUVD-2026-36756
GHSA-mhfm-9jg9-ph7h
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach device web interface
-
DeliverySend request to action_ims_on_with_apn
-
ExploitInject shell metacharacters via ims_apn
-
ExecutionCommand executed by router shell as root
-
ImpactFull device compromise / persistent backdoor
Vulnerability Assessment
| Weakness |
CWE
MITRE ATT&CK
2 techniques across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the ability to send an HTTP request to the device's web management interface and reach the action_ims_on_with_apn handler with an attacker-controlled ims_apn parameter; per the CVSS vector (PR:N/UI:N) no authentication or user interaction is required against the affected firmware. The concrete limiting factor is network reachability of the management UI: on typical consumer CPE the interface is LAN-bound, so true remote (Internet-side) exploitation additionally requires that remote/WAN management be enabled or the device be directly Internet-exposed. It is also constrained to the specific affected build - Tenda 5G03 firmware V05.03.02.04, hardware Version 1.0. |
| Impact | The raw CVSS 3.1 base score is 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating trivially exploitable unauthenticated remote code execution with total compromise - consistent with the SSVC assessment of Automatable=yes and Technical Impact=total. However, the signals partly conflict: SSVC Exploitation is 'none' (no observed exploitation), the issue is not in CISA KEV, and EPSS is only 0.52% (40th percentile), suggesting real-world exploitation is not currently widespread. A PoC/analysis reference is public, which raises the practical likelihood over time. A key caveat is exposure: the CVSS AV:N assumes the management interface is network-reachable to the attacker. On most consumer CPE deployments the web UI is bound to the LAN, so genuine unauthenticated remote (Internet-side) exploitation depends on whether remote management is enabled or the device is directly Internet-exposed - verify exposure before treating this as an Internet-facing 9.8. Net assessment: a legitimately high-impact, low-complexity RCE, but current exploitation pressure is modest and heavily dependent on device exposure. |
| Exploit ScenarioDerived | An attacker who can reach the Tenda 5G03 web interface (an untrusted LAN/Wi-Fi user, or anyone on the Internet if remote management is enabled) sends a crafted request to the action_ims_on_with_apn handler with an ims_apn value like 'apn;telnetd -l/bin/sh -p9999'. The unsanitized value is passed to a shell, spawning a root-level backdoor or reverse shell. Public PoC/analysis material for this exact endpoint exists, lowering the effort required to reproduce the attack. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 23, 2026
OS command injection in the Tenda 5G03 5G CPE router (firmware V05.03.02.04, hardware version 1.0) allows remote attackers to execute arbitrary shell commands by injecting metacharacters into the ims_apn parameter processed by the action_ims_on_with_apn function. Because the injected commands run with the router's elevated (typically root) web-server privileges, an attacker gains full control of the device. Publicly available exploit/proof-of-concept material exists in a third-party IoT vulnerability repository, though there is no public exploit identified as weaponized and the issue is not on the CISA KEV list; EPSS is low at 0.52%.
RemediationAI
No vendor-released patch or fixed firmware version has been identified from the available data, so remediation relies on compensating controls. Restrict access to the router's web management interface: ensure remote/WAN-side management is disabled so the interface is reachable only from trusted LAN hosts, and place the device behind a firewall that blocks inbound access to its HTTP(S) management port from the Internet - the trade-off is loss of remote administration convenience. Where feasible, segment the CPE onto a management VLAN and limit which internal hosts can reach the web UI, and change default administrative credentials to reduce the chance an attacker who is already on-network can reach the handler. Monitor the Tenda support site for updated 5G03 firmware superseding V05.03.02.04 and apply it once released. Consult the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-38065) for updates; note the PoC repository (https://github.com/sezangel/IOT-vul) documents the exact request and should be used to validate that any mitigation blocks the vulnerable action_ims_on_with_apn endpoint.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected device is a Tenda 5G03 4G/5G CPE (customer premises equipment) router that exposes a web management interface backed by CGI-style action handlers. The vulnerable handler, action_ims_on_with_apn, is responsible for enabling IMS (IP Multimedia Subsystem, used for VoLTE/voice services) with a caller-supplied APN (Access Point Name) value. The root cause is CWE-78 (Improper Neutralization of Special Elements used in an OS Command): the ims_apn parameter is passed into a shell command (commonly via system()/popen() in the C-based httpd found on these SoC-based routers) without sanitization, so shell metacharacters such as ; | ` $() break out of the intended command context. The CPE data is unhelpfully populated as 'cpe:2.3:a:n/a:n/a:*' (vendor/product literally 'n/a'), so the exact affected component must be taken from the description rather than the structured CPE.
Know when N A gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unsanitized ims_apn reaches a shell with no auth or interaction, giving root command execution, so AV:N/AC:L/PR:N/UI:N and full C/I/A; scope unchanged within the device.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
2DescriptionCVE.org
Tenda 5G03 V05.03.02.04 (Version 1.0) is vulnerable to Command injection in the function action_ims_on_with_apn via the ims_apn parameter.
Executive ViewAI
The Tenda 5G03 5G CPE router (firmware V05.03.02.04) contains a critical remote command injection vulnerability (CVSS 9.8) with publicly available exploit code; attackers could gain complete control of affected devices. Organizations deploying this specific model face full device compromise and potential network breach, particularly if devices are remotely accessible or used in critical infrastructure or branch office connectivity.
Disable remote management interfaces, restrict network access via firewall to trusted administrative sources, isolate router management to dedicated administrative networks, implement logging and monitoring for command injection attempts, and maintain device replacement readiness pending patch availability.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Exploit-DB