CVE-2026-5338
Last modified
CVE-2026-5338 is a low-severity vulnerability rated 2/10 on the CVSS scale. A security vulnerability has been detected in Tenda G103 1.0.0.5. The affected element is the function action_set_system_settings of the file system.lua of the component Setting Handler. EPSS estimates a 4.35% chance of exploitation in the next 30 days.
Description
A security vulnerability has been detected in Tenda G103 1.0.0.5. The affected element is the function action_set_system_settings of the file system.lua of the component Setting Handler. Such manipulation of the argument lanIp leads to command injection. The attack may be performed from remote. The exploit has been disclosed publicly and may be used.
Metrics
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Tenda | G103 Firmware | 1.0.0.5 |
References
- https://github.com/ZZ2266/.github.io/tree/main/Tenda%20G103/action_set_system_settingsExploit, Third Party Advisory
- https://vuldb.com/submit/781131Third Party Advisory, VDB Entry
- https://vuldb.com/vuln/354669Third Party Advisory, VDB Entry
- https://vuldb.com/vuln/354669/ctiPermissions Required, VDB Entry
- https://www.tenda.com.cn/Product
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2026-5338?
How severe is CVE-2026-5338?
How do I fix CVE-2026-5338?
Are you affected by CVE-2026-5338?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST