CVE-2026-38065: Tenda 5G03 V05

Synopsis

Command injection in the Tenda 5G03 V05 router firmware allows a remote, unauthenticated attacker to execute arbitrary operating system commands on the device. The vulnerability exists in the action_ims_on_with_apn function, where the ims_apn parameter is passed unsanitized to a system call, reachable over the network with no login required. Successful exploitation gives the attacker full control of the device, including access to all data passing through it, the ability to modify configuration and routing, and the ability to crash or brick the device. HarborGuard is tracking this advisory for patch availability as no fix version has been published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable endpoint is exposed over the network, meaning an attacker must be able to reach the device's HTTP interface remotely to deliver the malicious ims_apn payload.

• AuthenticationNot required

  No credentials or session token are needed; the vulnerable function is accessible to unauthenticated requests.

• Victim interactionNot required

  The attacker makes a direct request to the device; no user action or social-engineering step is required.

• Attack complexityDetail

  The exploit is reliable and condition-free: no race condition, memory layout knowledge, or environmental prerequisite is needed beyond network access to the target.

Blast Radius

• Attacker executes arbitrary OS commands as the firmware process owner, gaining a root-level shell on the router in typical embedded-Linux deployments.
• All network traffic routed through the device becomes readable, allowing interception of credentials, session tokens, and unencrypted payloads from connected clients.
• The attacker can modify routing tables, DNS settings, or firewall rules, redirecting or blocking traffic for any host on the network.
• The device can be crashed or rendered unbootable by overwriting firmware partitions or issuing destructive shell commands, disrupting network connectivity for all connected users.