CVE-2026-38061: Tenda 5G03 V05

Synopsis

Command injection in the Tenda 5G03 V05 router (firmware version V05.03.02.04) allows a remote, unauthenticated attacker to inject arbitrary operating system commands through the volume parameter of the action_set_volume function. The vulnerability is reachable over the network with no credentials required and no user interaction needed. Successful exploitation gives the attacker full control of the device, including the ability to read, modify, or delete data and crash or commandeer the affected service. HarborGuard is tracking this advisory for patch availability and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable function is exposed over the network, so an attacker must be able to reach the device's interface across the internet or an internal network segment.

• AuthenticationNot required

  No credentials of any privilege level are needed to invoke the action_set_volume function and deliver the malicious volume parameter.

• Victim interactionNot required

  The attacker sends a crafted request directly to the device; no user action such as clicking a link or opening a file is required.

• Attack complexityDetail

  The exploit is reliable and condition-free: no race conditions, specific memory layout, or environmental prerequisites are required to trigger command injection.

Blast Radius

• Attacker executes arbitrary operating system commands with the privilege level of the affected process, gaining a foothold on the device.
• Attacker reads sensitive data stored on the device, including configuration files, credentials, and network topology details.
• Attacker modifies device configuration or running state, redirecting traffic, disabling security controls, or installing persistent backdoors.
• Attacker crashes or fully disrupts the device, taking down network connectivity for all clients that depend on it.