EUVD-2026-18342
GHSA-7g3h-f8vq-89vv
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
Lifecycle Timeline
6DescriptionCVE.org
A vulnerability was detected in Tenda G103 1.0.0.5. The impacted element is the function action_set_net_settings of the file gpon.lua of the component Setting Handler. Performing a manipulation of the argument authLoid/authLoidPassword/authPassword/authSerialNo/authType/oltType/usVlanId/usVlanPriority results in command injection. It is possible to initiate the attack remotely. The exploit is now public and may be used.
AnalysisAI
Command injection in Tenda G103 1.0.0.5 setting handler allows high-privilege remote attackers to execute arbitrary commands via manipulation of multiple GPON authentication parameters (authLoid, authLoidPassword, authPassword, authSerialNo, authType, oltType, usVlanId, usVlanPriority) in the gpon.lua component. Publicly available exploit code exists, though the CVSS:3.1/AV:N/AC:L/PR:H vector indicates attacks require high administrative privileges and deliver limited impact (confidentiality, integrity, availability each L). This is a realistic but constrained threat: exploitation requires authenticated admin-level access to a device already on the network.
Technical ContextAI
The vulnerability resides in the gpon.lua setting handler component of Tenda G103, which processes GPON (Gigabit Passive Optical Network) configuration parameters. The root cause is CWE-77 (Improper Neutralization of Special Elements used in a Command), indicating insufficient input validation or output encoding of user-supplied arguments before they are passed to shell execution contexts. The affected parameters (authLoid, authLoidPassword, authPassword, authSerialNo, authType, oltType, usVlanId, usVlanPriority) are common GPON authentication and VLAN configuration fields; when manipulated with command metacharacters, they traverse unfiltered into command execution. The vulnerability affects Tenda G103 across all versions indicated by the CPE cpe:2.3:a:tenda:g103:*:*:*:*:*:*:*:*.
RemediationAI
No vendor-released patch or fixed version has been identified in the provided data. Immediate mitigations include: restrict network access to the Tenda G103 administrative interface (port 80/443) to authorized management networks only, use firewall rules to limit admin API exposure, enforce strong and unique administrative credentials, and disable remote management if not operationally necessary. Monitor admin authentication logs for anomalous access patterns. Check Tenda's official security advisories (https://www.tenda.com.cn/) and contact vendor support to determine if a firmware update addressing CWE-77 input validation is available for your specific device version. Until a patch is confirmed, network segmentation and access control are the primary protective measures.
Same weakness CWE-77 – Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today