Tenda CVE-2026-5338

Q: What is the CVSS score of CVE-2026-5338?

CVE-2026-5338 has a CVSS 4.0 base score of 2.0 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.6%.

EUVD-2026-18340 LOW

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2026-04-02 cna@vuldb.com

GHSA-jwm4-jqjj-6v3x

Tenda Command Injection

2.0

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.0 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:11 NVD

5.1 (MEDIUM) 2.0 (LOW)

EUVD ID Assigned

Apr 02, 2026 - 14:22 euvd

EUVD-2026-18340

Analysis Generated

Apr 02, 2026 - 14:22 vuln.today

CVE Published

Apr 02, 2026 - 14:16 nvd

MEDIUM 5.1

DescriptionCVE.org

A security vulnerability has been detected in Tenda G103 1.0.0.5. The affected element is the function action_set_system_settings of the file system.lua of the component Setting Handler. Such manipulation of the argument lanIp leads to command injection. The attack may be performed from remote. The exploit has been disclosed publicly and may be used.

AnalysisAI

Command injection in Tenda G103 1.0.0.5 allows high-privileged remote attackers to execute arbitrary commands via the lanIp parameter in the action_set_system_settings function of system.lua. The vulnerability requires administrative credentials (PR:H) but has publicly available exploit code and impacts system confidentiality, integrity, and availability. CVSS score 5.1 reflects the elevated privilege requirement despite network-based attack vector.

Technical ContextAI

The vulnerability resides in the Setting Handler component of Tenda G103, specifically in the system.lua file's action_set_system_settings function. CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component, also known as 'Injection') indicates insufficient input validation or sanitization of the lanIp parameter before it is passed to downstream command execution. The lanIp argument is processed without adequate filtering of shell metacharacters, allowing an authenticated administrator to inject arbitrary shell commands that execute with the privileges of the web service or system process handling the request. The Tenda G103 is a wireless router with web-based administration interface, making this a device management vulnerability affecting the router's configuration and operational integrity.

RemediationAI

Primary mitigation is to upgrade Tenda G103 to a patched firmware version released by Tenda after 1.0.0.5; consult https://www.tenda.com.cn/ for the latest firmware release and installation instructions. If no patched version is immediately available, temporarily restrict administrative access to trusted networks only, disable remote administration features if not required, and monitor authentication logs for unauthorized access attempts. Input validation should be implemented server-side to sanitize the lanIp parameter, removing or escaping shell metacharacters before passing to any system command execution function. Tenda security advisories and firmware updates should be tracked via their official support channels.