Executive Summary

The CVE-2026-38063 vulnerability affects the Tenda 5G03 router with firmware version V05.03.02.04. It is a command injection vulnerability located in the function action_radio_on_with_ia_apn, specifically due to improper sanitization of the ia parameter.

An attacker can exploit this vulnerability by sending a specially crafted POST request to the endpoint /cgi-bin/luci/admin/telephony/trigger_set_radio_on_with_ia with a malicious ia parameter. This allows the attacker to execute arbitrary commands on the router.

Useful 0 Not Useful 0

Impact Analysis

Successful exploitation of this vulnerability grants an attacker the ability to run arbitrary commands on the affected Tenda 5G03 router. This can lead to unauthorized control over the device, potentially allowing the attacker to manipulate router settings, intercept or redirect network traffic, install malicious software, or disrupt network operations.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by attempting to exploit the command injection in the ia parameter of the vulnerable endpoint. Specifically, sending a crafted POST request to the endpoint /cgi-bin/luci/admin/telephony/trigger_set_radio_on_with_ia with a malicious ia parameter can confirm the presence of the vulnerability.

• Send a POST request with the payload ia="any_ia"; touch /tmp/RADIO_IA_VULN_PROVED; # to the URL /cgi-bin/luci/admin/telephony/trigger_set_radio_on_with_ia.
• Check if the file /tmp/RADIO_IA_VULN_PROVED is created on the device, which indicates successful command injection.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate the CVE-2026-38063 vulnerability in the Tenda 5G03 router, immediate steps include avoiding exposure of the vulnerable endpoint to untrusted networks and restricting access to the router's administrative interface.

Specifically, do not send or allow POST requests to the endpoint `/cgi-bin/luci/admin/telephony/trigger_set_radio_on_with_ia` with untrusted input in the `ia` parameter, as it is vulnerable to command injection.

If possible, disable remote administration or restrict it to trusted IP addresses only.

Monitor the device for any suspicious files or commands, such as the presence of `/tmp/RADIO_IA_VULN_PROVED`, which indicates exploitation.

Finally, check for firmware updates or patches from the vendor that address this vulnerability and apply them as soon as they become available.

Useful 0 Not Useful 0