CVE-2026-38064: Tenda 5G03 V05

Synopsis

Command injection in Tenda 5G03 V05 (firmware version 05.03.02.04) allows a remote attacker to inject arbitrary operating system commands through the dialNumber parameter in the action_dial_call function. The vulnerability is reachable over the network with no authentication required and no user interaction needed. Successful exploitation gives the attacker full control of the device, including the ability to read all stored data, modify configuration and files, and crash or hijack running processes. HarborGuard is tracking this advisory and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable function is exposed over the network, so an attacker must be able to reach the device's network interface to deliver the malicious payload.

• AuthenticationNot required

  No credentials or session token of any kind are needed; the injection point in the dialNumber parameter accepts unauthenticated input.

• Victim interactionNot required

  The attacker sends a crafted request directly to the device with no need for any user to click a link or take any action.

• Attack complexityDetail

  Exploitation is reliable and condition-free; no race conditions, memory layout knowledge, or special environmental factors are required to trigger the injection.

Blast Radius

• Attacker executes arbitrary OS commands as the process owner, gaining an interactive shell or the ability to run scripts on the device.
• All data stored on the device, including credentials, configuration files, and session material, becomes readable.
• Attacker can overwrite firmware settings, inject persistent backdoors, or modify routing and firewall rules.
• The device can be crashed or held in a denial-of-service state, disrupting all traffic passing through it.