PT-2026-29748 · Tenda · Tenda G103

N0Ps1Ed · CVE-2026-5339 · Published 2026-04-02 · Updated 2026-04-02

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Tenda G103 version 1.0.0.5

Description A flaw exists in the Setting Handler component of the Tenda G103, specifically within the action set net settings function of the gpon.lua file. Manipulation of the authLoid, authLoidPassword, authPassword, authSerialNo, authType, oltType, usVlanId, or usVlanPriority arguments can lead to command injection. This issue is remotely exploitable.

Recommendations Update to a newer version that contains a fix for this vulnerability.

Exploit

Fix

Command Injection

Special Elements Injection

Weakness Enumeration

CWE-77

CWE-74

Related Identifiers

CVE-2026-5339

Affected Products

Tenda G103

References · 14

• 🔥 https://github.com/ZZ2266/.github.io/tree/main/Tenda%20G103/authLoid · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-5339 · Security Note
• https://vuldb.com/submit/781134 · Note
• https://vuldb.com/vuln/354670 · Note
• https://vuldb.com/submit/781133 · Note
• https://vuldb.com/vuln/354670/cti · Note
• https://twitter.com/CVEnew/status/2039744337894928629 · Twitter Post
• https://vuldb.com/submit/781132 · Note
• https://vuldb.com/submit/781135 · Note
• https://vuldb.com/submit/781145 · Note
• https://vuldb.com/submit/781142 · Note
• https://vuldb.com/submit/781143 · Note
• https://tenda.com.cn · Note
• https://vuldb.com/submit/781144 · Note