PT-2026-29748 · Tenda · G103

N0Ps1Ed · Published 2026-04-02 · Updated 2026-04-02 · CVE-2026-5339

Mitre

CVSS v3.1

4.7

Medium

AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L

A vulnerability was detected in Tenda G103 1.0.0.5. The impacted element is the function action set net settings of the file gpon.lua of the component Setting Handler. Performing a manipulation of the argument authLoid/authLoidPassword/authPassword/authSerialNo/authType/oltType/usVlanId/usVlanPriority results in command injection. It is possible to initiate the attack remotely. The exploit is now public and may be used.

Exploit

Fix

Special Elements Injection

Command Injection

Weakness Enumeration

CWE-74

CWE-77

Related Identifiers

CVE-2026-5339

Affected Products

G103

References · 13

• 🔥 https://github.com/ZZ2266/.github.io/tree/main/Tenda%20G103/authLoid · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-5339 · Security Note
• https://vuldb.com/submit/781145 · Note
• https://vuldb.com/submit/781142 · Note
• https://vuldb.com/submit/781135 · Note
• https://vuldb.com/submit/781132 · Note
• https://tenda.com.cn · Note
• https://vuldb.com/vuln/354670/cti · Note
• https://vuldb.com/submit/781143 · Note
• https://vuldb.com/submit/781144 · Note
• https://vuldb.com/vuln/354670 · Note
• https://vuldb.com/submit/781133 · Note
• https://vuldb.com/submit/781134 · Note