EUVD-2026-18340
GHSA-jwm4-jqjj-6v3x
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Input neutralization, injection prevention
|
| Impact | Despite the CVSS 5.1 score, which is below the traditional 7.0 'high' threshold, this vulnerability carries moderate real-world risk. The CVSS vector shows attack complexity is low (AC:L) and requires only network access (AV:N), but crucially depends on high privileges (PR:H), meaning only administrators can exploit it-this substantially reduces the threat surface compared to an unauthenticated flaw. EPSS data is not provided, but the presence of public exploit code (E:P in vector) increases practical exploitability risk for defenders who may face insider threats or scenarios where admin credentials are compromised. The technical impact is limited to confidentiality, integrity, and availability (VC:L, VI:L, VA:L), suggesting the command injection does not escalate to system-level compromise or persistence. SSVC considerations: exploitation is possible (POC exists), impact is technical but not catastrophic, and automation is likely feasible for someone with admin access. This is a real priority for Tenda G103 administrators in environments with strict insider-threat policies, but lower-priority than unauthenticated RCE vulnerabilities. |
| Exploit ScenarioDerived | An administrator (or an attacker who has obtained valid admin credentials through phishing or credential compromise) logs into the Tenda G103 web interface and crafts a malicious HTTP request to the action_set_system_settings endpoint, injecting shell commands into the lanIp parameter-for example, lanIp=192.168.1.1;id;. The vulnerable system.lua function fails to sanitize this input and executes the injected commands (id, and any subsequent commands), allowing the attacker to enumerate system users, read configuration files, or modify router settings without additional exploitation steps. Public exploit code referenced in the disclosure materials likely automates this request construction and payload delivery. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 02, 2026
Command injection in Tenda G103 1.0.0.5 allows high-privileged remote attackers to execute arbitrary commands via the lanIp parameter in the action_set_system_settings function of system.lua. The vulnerability requires administrative credentials (PR:H) but has publicly available exploit code and impacts system confidentiality, integrity, and availability. CVSS score 5.1 reflects the elevated privilege requirement despite network-based attack vector.
RemediationAI
Primary mitigation is to upgrade Tenda G103 to a patched firmware version released by Tenda after 1.0.0.5; consult https://www.tenda.com.cn/ for the latest firmware release and installation instructions. If no patched version is immediately available, temporarily restrict administrative access to trusted networks only, disable remote administration features if not required, and monitor authentication logs for unauthorized access attempts. Input validation should be implemented server-side to sanitize the lanIp parameter, removing or escaping shell metacharacters before passing to any system command execution function. Tenda security advisories and firmware updates should be tracked via their official support channels.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability resides in the Setting Handler component of Tenda G103, specifically in the system.lua file's action_set_system_settings function. CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component, also known as 'Injection') indicates insufficient input validation or sanitization of the lanIp parameter before it is passed to downstream command execution. The lanIp argument is processed without adequate filtering of shell metacharacters, allowing an authenticated administrator to inject arbitrary shell commands that execute with the privileges of the web service or system process handling the request. The Tenda G103 is a wireless router with web-based administration interface, making this a device management vulnerability affecting the router's configuration and operational integrity.
Know when G103 Firmware gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Primary rating from Vendor (vuldb) · only source for this CVE.
CVSS VectorVendor: vuldb
Lifecycle Timeline
3DescriptionCVE.org
A security vulnerability has been detected in Tenda G103 1.0.0.5. The affected element is the function action_set_system_settings of the file system.lua of the component Setting Handler. Such manipulation of the argument lanIp leads to command injection. The attack may be performed from remote. The exploit has been disclosed publicly and may be used.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
More in G103 Firmware
View allCommand injection vulnerability found in Tenda G103 v.1.0.0.5 allows attacker to execute arbitrary code via a the langua
Command Injection vulnerability found in Tenda G103 v.1.0.05 allows an attacker to obtain sensitive information via a cr
There is a command injection vulnerability in the Tenda G103 Gigabit GPON Terminal with firmware version V1.0.0.5. Rated
Exploit-DB