Executive brief
The Tenda 5G03 is a 5G wireless router used to provide high-speed internet connectivity. A security flaw in the device's SIM card management interface allows an attacker to execute unauthorized commands on the router's operating system. This could lead to a complete takeover of the device, allowing an attacker to intercept network traffic or disrupt internet services.
Technical details
A command injection vulnerability exists in the Tenda 5G03 router within the '/usr/lib/lua/luci/controller/admin/telephony.lua' file. The 'action_unlock_sim' function fails to properly sanitize the 'pin' parameter before passing it to a system shell. An authenticated attacker with access to the web management interface can exploit this by sending a specially crafted POST request to the '/cgi-bin/luci/admin/telephony/trigger_sim_unlock' endpoint. Successful exploitation allows for arbitrary command execution with the privileges of the web server, typically root on such embedded devices.
Affected products
- Tenda 5G03 V05.03.02.04 (Version 1.0)
Timeline
- 2026-03-16: disclosed: Initial discovery and submission date by researcher
- 2026-06-15: advisory: CVE published to NVD