EUVD-2026-36754
GHSA-235f-qxww-6764
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach router HTTP management interface
-
DeliverySend crafted request to action_radio_on_with_ia_apn
-
ExploitInject shell metacharacters via 'ia' parameter
-
ExecutionBreak out into OS command execution
-
PersistRun arbitrary commands as router service
-
ImpactFull device takeover and network pivot
Vulnerability Assessment
| Weakness |
CWE
MITRE ATT&CK
2 techniques across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to reach the router's HTTP management interface and send a request to the action_radio_on_with_ia_apn function with a malicious value in the 'ia' (APN) parameter - this specific endpoint and parameter ARE the required condition. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no authentication, no user interaction, and no special configuration are required against the affected firmware V05.03.02.04. The primary limiting factor is network reachability of the management web interface: on a typical SOHO deployment this endpoint is LAN-facing, so remote Internet exploitation depends on WAN-side management being enabled or the attacker already being on the local/adjacent network. Confirmed affected build is Tenda 5G03 V05.03.02.04, hardware Version 1.0. |
| Impact | The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H = 9.8) indicates trivial, unauthenticated, network-based exploitation with total impact, and SSVC corroborates this with Automatable:yes and Technical Impact:total. However, these signals are in tension with real-world exposure: the SSVC Exploitation status is 'none' (no observed exploitation), EPSS is low at 0.45% (36th percentile), and the device is a consumer/SOHO 5G router whose management interface is typically LAN-facing rather than Internet-exposed. So while the technical severity is genuinely critical (full device takeover, publicly available PoC), the practical priority depends heavily on whether the router's web interface is reachable from the attacker's network - AV:N assumes network reachability, but embedded router bugs like this are most often exploited from the LAN or via CSRF-style pivots unless the WAN management interface is enabled. Treat as high priority for exposed/managed fleets, moderate for typical LAN-only deployments. Note the CPE and affected-version data are placeholders ('n/a'), so precise version scoping relies on the description alone. |
| Exploit ScenarioDerived | An attacker with network access to the router's web management interface sends a crafted HTTP request to the action_radio_on_with_ia_apn endpoint with shell metacharacters embedded in the 'ia' APN parameter. The injected command runs on the router's OS (typically as a privileged/root service account), letting the attacker take full control of the device, intercept or reroute traffic, and pivot into the network. A public PoC/write-up demonstrating the injection is available on GitHub, lowering the skill required. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 23, 2026
Command injection in the Tenda 5G03 5G/LTE router (firmware V05.03.02.04, hardware version 1.0) allows remote attackers to inject arbitrary OS commands through the 'ia' parameter processed by the action_radio_on_with_ia_apn function. The flaw carries a 9.8 CVSS and, per its CVSS vector, is network-reachable without authentication or user interaction, giving full command execution on the device. There is publicly available exploit code (a public PoC/write-up on GitHub), though EPSS remains modest at 0.45% and there is no evidence of active exploitation.
RemediationAI
No vendor-released patch identified at time of analysis - no fixed firmware version or Tenda security advisory is present in the provided data, so monitor Tenda's official support/download pages for a firmware update superseding V05.03.02.04 and apply it once released. As compensating controls until a patch exists: disable remote/WAN-side web management on the router so the vulnerable interface is not reachable from the Internet (trade-off: loss of remote administration convenience); restrict access to the router's HTTP management interface to a trusted management VLAN or specific admin hosts via firewall/ACL (trade-off: administrative overhead); and change default credentials and segment the router off untrusted LAN clients to reduce internal exposure. Because the injection is in the APN-related action_radio_on_with_ia_apn endpoint, blocking untrusted network access to the device's HTTP admin service is the most effective mitigation. Reference the technical details at https://github.com/sezangel/IOT-vul/tree/main/Tenda/5G03/action_radio_on_with_ia_apn and https://nvd.nist.gov/vuln/detail/CVE-2026-38063.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected device is the Tenda 5G03, a small-office/home 5G CPE router. The root cause is CWE-78 (Improper Neutralization of Special Elements used in an OS Command), meaning the value supplied in the 'ia' (APN-related) parameter is passed into a shell/system call inside the action_radio_on_with_ia_apn handler without adequate sanitization, so shell metacharacters break out of the intended command and execute attacker-controlled commands. This is a classic embedded-router web/CGI backend injection where APN configuration input is concatenated into a command string. Note the CPE provided is a placeholder ('cpe:2.3:a:n/a:n/a:*') and does not properly identify the product; the actual affected item is the Tenda 5G03 firmware/hardware combination named in the description, not a generically-CPE'd application.
Know when N A gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated command injection reachable over the network on a default endpoint yields PR:N/UI:N and full C/I/A on the device; AV:N reflects reachable web management interface.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
2DescriptionCVE.org
Tenda 5G03 V05.03.02.04 (Version 1.0) is vulnerable to Command injection in the function action_radio_on_with_ia_apn via the ia parameter.
Executive ViewAI
The Tenda 5G03 router (firmware V05.03.02.04) contains a critical remote command injection vulnerability (CVE-2026-38063, CVSS 9.8) allowing unauthenticated network attacks to gain arbitrary command execution on affected devices. Publicly available exploit code exists, and the flaw requires no user interaction, creating immediate risk of complete device and network infrastructure compromise. Organizations deploying this router model face severe exposure until remediation is applied.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) network segmentation or air-gapping of affected routers to limit exposure surface; (2) firewall-enforced administrative access restrictions to authorized IP ranges only; (3) behavioral monitoring and alerting for exploitation attempts targeting the 'ia' parameter and command injection vectors; (4) disabling unnecessary remote management capabilities on affected devices through firmware configuration if supported; (5) accelerated procurement and deployment of replacement router models from vendors with active security update cycles.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Exploit-DB