EUVD-2026-36752
GHSA-2p5w-f38x-fgff
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated command injection (PR:N/UI:N) executing as root gives total C/I/A; AV:N retained per reported vector though real reach is often LAN-only, which would lower it to AV:A.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
Tenda 5G03 V05.03.02.04 (Version 1.0) is vulnerable to Command injection in the function action_set_volume via the volume parameter.
AnalysisAI
OS command injection in the Tenda 5G03 5G CPE router (firmware V05.03.02.04) lets an attacker inject shell commands through the volume parameter of the action_set_volume handler, yielding full command execution on the device. Per the published CVSS vector the flaw is remotely reachable without authentication or user interaction, and publicly available exploit code exists (a proof-of-concept in the sezangel/IOT-vul research repository); it is not listed in CISA KEV and carries a modest EPSS of 0.45% (36th percentile), indicating no confirmed active exploitation yet. SSVC rates technical impact as total and the flaw as automatable, so successful exploitation gives complete control of the router.
Technical ContextAI
The Tenda 5G03 is a consumer/SMB 5G LTE CPE router whose web management/HTTP service exposes action handlers implemented in the device's httpd/CGI binary. The vulnerable function action_set_volume passes the attacker-supplied volume parameter into an OS command context (e.g. a system()/popen()-style call or shell string) without sanitization, the classic CWE-78 'Improper Neutralization of Special Elements used in an OS Command' pattern. Because embedded router firmware typically runs its web service and spawned commands as root on a BusyBox/Linux stack, injected metacharacters (;, |, `, &&) execute with the highest privilege on the device. Note the CPE string supplied (cpe:2.3:a:n/a:n/a:*) is a placeholder and does not actually identify the product; identification here rests on the description text and tags (Tenda, Command Injection).
RemediationAI
No vendor-released patch identified at time of analysis, so apply compensating controls. Restrict access to the router's HTTP management interface: disable any remote/WAN-side web management so the interface is not reachable from the internet, and limit LAN access to trusted administration hosts or a management VLAN - the trade-off is reduced remote administrability. Where feasible, block inbound access to the device's web-management port from untrusted networks at an upstream firewall, accepting that legitimate remote admin will also be blocked. Change default administrative credentials and monitor the device for unexpected outbound connections or process activity as an interim detection measure. Track the Tenda security portal and the CVE/EUVD records (https://nvd.nist.gov/vuln/detail/CVE-2026-38061) for a firmware update and upgrade to a fixed build once released; if this model is end-of-life, plan hardware replacement.
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Same weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today