Executive brief
The Tenda 5G03 router is vulnerable to a security flaw that allows an attacker to take control of the device. By sending a specially crafted request to the router's management interface, an attacker can execute unauthorized commands. This could lead to a complete compromise of the network traffic passing through the router or a total service outage.
Technical details
A command injection vulnerability exists in the Tenda 5G03 router firmware version V05.03.02.04. The flaw is located in the 'action_radio_on_with_ia_apn' function within the '/usr/lib/lua/luci/controller/admin/telephony.lua' script. The 'ia' parameter is processed without sufficient sanitization before being passed to a system shell, allowing an authenticated attacker to inject arbitrary shell commands. Exploitation requires a valid session ID (sysauth cookie) and involves sending a POST request to the '/cgi-bin/luci/admin/telephony/trigger_set_radio_on_with_ia' endpoint. Successful exploitation grants the attacker root-level command execution on the underlying Linux operating system.
Affected products
- Tenda 5G03 V05.03.02.04 (Version 1.0)
Timeline
- 2026-03-16: disclosed: Vulnerability submitted to vendor/research community
- 2026-06-15: advisory: CVE published by NVD/MITRE