EUVD-2026-18342
GHSA-7g3h-f8vq-89vv
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Command injection prevention
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | The CVSS score of 4.7 reflects a moderate-to-low severity profile: the attack vector is network-accessible (AV:N) with low complexity (AC:L), but critically requires high privileges (PR:H-authenticated admin-level access) and yields only partial impact across confidentiality, integrity, and availability (all L). The EPSS and real-world exploitation probability are tempered by the authentication barrier. However, the CVSS evidence tag (E:P) signals exploit proof-of-concept availability, and public code repositories confirm this. The SSVC decision framework would classify this as lower priority: although exploitability is confirmed (public POC), the automatable attack surface is limited to users already holding high-privilege administrative credentials on a deployed Tenda G103 device. In typical enterprise or ISP environments, such admin accounts are centrally managed and audited, reducing the attack surface. Conversely, in small office/home office (SOHO) deployments or poorly secured installations, an attacker with stolen admin credentials could pivot to command execution. Risk priority should be contextualized by deployment scope and credential hygiene. |
| Exploit ScenarioDerived | An attacker with valid high-privilege (admin) credentials to a Tenda G103 device could craft a POST or GET request to the gpon.lua setting handler's action_set_net_settings function, injecting shell metacharacters (e.g., semicolons, pipes, backticks) into the authLoid or usVlanId parameter. The unvalidated input is executed by the device's system shell, allowing the attacker to run arbitrary commands with device privileges-for example, exfiltrating configuration data, modifying firewall rules, or establishing persistence. Public exploit code demonstrates this via GitHub repositories documenting the attack methodology. While the scenario requires pre-existing admin access (high barrier), compromised ISP technician accounts, weak default credentials, or lateral movement from a network foothold could provide the attacker with such credentials. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 02, 2026
Command injection in Tenda G103 1.0.0.5 setting handler allows high-privilege remote attackers to execute arbitrary commands via manipulation of multiple GPON authentication parameters (authLoid, authLoidPassword, authPassword, authSerialNo, authType, oltType, usVlanId, usVlanPriority) in the gpon.lua component. Publicly available exploit code exists, though the CVSS:3.1/AV:N/AC:L/PR:H vector indicates attacks require high administrative privileges and deliver limited impact (confidentiality, integrity, availability each L). This is a realistic but constrained threat: exploitation requires authenticated admin-level access to a device already on the network.
RemediationAI
No vendor-released patch or fixed version has been identified in the provided data. Immediate mitigations include: restrict network access to the Tenda G103 administrative interface (port 80/443) to authorized management networks only, use firewall rules to limit admin API exposure, enforce strong and unique administrative credentials, and disable remote management if not operationally necessary. Monitor admin authentication logs for anomalous access patterns. Check Tenda's official security advisories (https://www.tenda.com.cn/) and contact vendor support to determine if a firmware update addressing CWE-77 input validation is available for your specific device version. Until a patch is confirmed, network segmentation and access control are the primary protective measures.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability resides in the gpon.lua setting handler component of Tenda G103, which processes GPON (Gigabit Passive Optical Network) configuration parameters. The root cause is CWE-77 (Improper Neutralization of Special Elements used in a Command), indicating insufficient input validation or output encoding of user-supplied arguments before they are passed to shell execution contexts. The affected parameters (authLoid, authLoidPassword, authPassword, authSerialNo, authType, oltType, usVlanId, usVlanPriority) are common GPON authentication and VLAN configuration fields; when manipulated with command metacharacters, they traverse unfiltered into command execution. The vulnerability affects Tenda G103 across all versions indicated by the CPE cpe:2.3:a:tenda:g103:*:*:*:*:*:*:*:*.
Know when G103 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
Lifecycle Timeline
4DescriptionCVE.org
A vulnerability was detected in Tenda G103 1.0.0.5. The impacted element is the function action_set_net_settings of the file gpon.lua of the component Setting Handler. Performing a manipulation of the argument authLoid/authLoidPassword/authPassword/authSerialNo/authType/oltType/usVlanId/usVlanPriority results in command injection. It is possible to initiate the attack remotely. The exploit is now public and may be used.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
Exploit-DB