CVE-2026-38062: Tenda 5G03 V05

Synopsis

Command injection in the Tenda 5G03 V05 router allows a remote attacker to execute arbitrary operating system commands on the device. The vulnerability is reachable over the network without any authentication, via the ratMode parameter in the action_set_rat_mode function. Successful exploitation gives the attacker full control of the device, including the ability to read all data, modify configurations, and disrupt network service. HarborGuard tracks this advisory and will make a patched-image rebuild available as soon as an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable endpoint is exposed over the network, meaning an attacker must be able to reach the device's HTTP service remotely; no physical or local access is needed.

• AuthenticationNot required

  No credentials are required; the vulnerable function can be invoked by any unauthenticated caller that can reach the device.

• Victim interactionNot required

  Exploitation is entirely attacker-driven and requires no action from any user of the device.

• Attack complexityDetail

  Exploit conditions are straightforward and reliable, with no race conditions or special environmental dependencies required to trigger the injection.

Blast Radius

• Attacker executes arbitrary OS commands on the router with the privileges of the web server process, gaining a foothold on the device.
• All data handled by the device, including network credentials and configuration secrets stored in flash, becomes readable.
• The attacker can overwrite firmware settings or inject persistent backdoors, modifying device behavior for all connected users.
• The router can be crashed or rendered non-functional, cutting off network access for every client depending on it.