Executive brief
The Tenda 5G03 router, a device used to provide 5G wireless internet connectivity, contains a security flaw in its volume control settings. An attacker with access to the router's management interface can send a specially crafted command that allows them to take full control of the device. This could lead to the interception of internet traffic, unauthorized access to the local network, or a complete shutdown of the router's services.
Technical details
A command injection vulnerability exists in the Tenda 5G03 router firmware version V05.03.02.04 (Version 1.0). The flaw is located within the 'action_set_volume' function in the '/usr/lib/lua/luci/controller/admin/telephony.lua' script. The 'volume' parameter is processed without sufficient sanitization or validation before being passed to a system shell. An authenticated attacker can exploit this by sending a POST request to the '/cgi-bin/luci/admin/telephony/trigger_call_set_volume' endpoint with a malicious payload in the 'volume' field. Successful exploitation results in arbitrary command execution with the privileges of the web server (typically root on such devices).
Affected products
- Tenda 5G03 V05.03.02.04 (Version 1.0)
Timeline
- 2026-03-16: disclosed: Initial discovery and submission by researcher.
- 2026-06-15: advisory: CVE published by MITRE/NVD.