Tenda 4G300 EUVD-2026-26306

Authentication as a valid router user account (admin or guest account with sufficient privileges) is REQUIRED - the CVSS PR:L vector confirms this. The /goform/DelFil endpoint must be accessible over the network (typically requires WAN/LAN access to the router's web interface, unless exposed via port forwarding or compromised internal network). No non-default configuration is required; the vulnerability exists in standard firmware behavior. The vulnerability is LIMITED by: (1) need for valid credentials - unauthenticated network reconnaissance alone cannot trigger exploitation, (2) AC:L means attack complexity is low once authenticated (no race conditions or user interaction required), (3) presence of WAF or input validation filters upstream of the router (unlikely in consumer routers) would mitigate.

CVSS 6.3 with AV:N/AC:L/PR:L/UI:N indicates network-accessible remote code execution requiring only low-privilege authentication and no user interaction - a meaningful risk vector. However, the PR:L (low privilege required) requirement significantly reduces real-world impact compared to unauthenticated RCE. EPSS data is unavailable, but public POC availability combined with command injection severity suggests moderate exploitation likelihood. The vulnerability is not listed in CISA KEV, indicating no confirmed active exploitation in the wild despite public POC. For organizations using Tenda 4G300 in production, this remains a priority for authenticated attackers with network access (e.g., compromised admin accounts, insider threats, or lateral movement scenarios). The moderate CVSS score appropriately reflects the authentication gate, which is the primary limiting factor. Risk is conditioned on: (1) router exposed to potential authenticated attackers, (2) user maintaining older firmware version, (3) admin or guest account compromise.

An attacker with valid router admin credentials (obtained via credential compromise, phishing, or default credentials) sends a crafted HTTP POST request to /goform/DelFil with a malicious delflag parameter containing shell metacharacters or command operators (e.g., delflag=id or delflag=$(whoami)). The vulnerable sub_425A28 function executes the parameter unsanitized in a system command context, allowing the attacker to execute arbitrary commands as the router's web service process. Public POC is available on GitHub demonstrating the injection payload construction.