CVE-2026-38060: Tenda 5G03 V05

Synopsis

Command injection in the Tenda 5G03 V05.03.02.04 router allows a remote, unauthenticated attacker to inject arbitrary operating system commands through the pin parameter of the action_unlock_sim function. The vulnerability is reachable over the network and requires no credentials or user interaction. Successful exploitation gives the attacker full control over the device, including the ability to read, modify, or delete data and crash or hijack the running system. HarborGuard is tracking the upstream advisory for patch availability, as no fix version has been published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable function is exposed over the network, so the attacker must be able to reach the device's network interface to send a crafted request.

• AuthenticationNot required

  No credentials of any privilege level are required; the action_unlock_sim endpoint accepts unauthenticated requests.

• Victim interactionNot required

  The attack is fully server-side and completes without any action from a user or administrator on the target device.

• Attack complexityDetail

  Exploitation is reliable and condition-free; no race conditions, special memory layout, or environmental prerequisites are needed.

Blast Radius

• A successful attacker can execute arbitrary operating system commands on the router, gaining full shell-level control of the device.
• Confidential data stored on or passing through the device, including network credentials and SIM-related parameters, becomes readable to the attacker.
• The attacker can modify device configuration, routing rules, or firmware state, enabling persistent access or traffic interception.
• The attacker can crash or fully disable the router, cutting off network connectivity for all clients depending on the device.