CVE-2026-38063: Tenda 5G03 V05

Synopsis

Command injection in the Tenda 5G03 V05 router (firmware version 05.03.02.04) allows a remote, unauthenticated attacker to inject arbitrary OS commands via the ia parameter of the action_radio_on_with_ia_apn function. The vulnerability is reachable over the network with no authentication and no user interaction required. Successful exploitation gives the attacker full control over the device, including the ability to read, modify, or destroy data and crash or commandeer the affected router. No fix version has been published; HarborGuard tracks this advisory and will surface a patched rebuild the moment an upstream fix becomes available.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable function is exposed over the network, meaning an attacker must be able to reach the device's network interface to send a crafted request.

• AuthenticationNot required

  No account or credential of any privilege level is needed to reach or exploit the vulnerable endpoint.

• Victim interactionNot required

  Exploitation is fully attacker-driven and requires no action from any user of the device.

• Attack complexityDetail

  The exploit is reliable and condition-free: no race conditions, memory layout knowledge, or special environmental factors are needed to trigger the injection.

Blast Radius

• A successful attacker can execute arbitrary OS commands on the router with the process's privilege level, gaining effective control of the device.
• Confidential data stored on or passing through the device, such as credentials, session tokens, and network traffic, is readable by the attacker.
• The attacker can modify device configuration, routing rules, or firmware, redirecting or intercepting traffic for downstream network users.
• The attacker can crash or reboot the device, cutting off network connectivity for all clients that depend on it.