Command Injection in Tenda 5G03 Router

Executive Summary

CVE-2026-38065 is a command injection vulnerability found in Tenda 5G03 devices running firmware version V05.03.02.04. The flaw exists in the function named action_ims_on_with_apn, specifically in how it handles the ims_apn parameter. This parameter is not properly sanitized, which means an attacker can inject arbitrary commands into the system by crafting a malicious ims_apn value.

For example, an attacker can send a specially crafted HTTP POST request containing a malicious ims_apn value such as ";touch /tmp/CLTaint_VULN_PROVED;". This causes the device to execute the injected command, potentially allowing unauthorized actions on the device.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows an attacker to execute arbitrary commands on the affected Tenda 5G03 device remotely. This can lead to unauthorized control over the device, potentially allowing the attacker to modify system files, disrupt device functionality, or use the device as a foothold for further attacks within the network.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by checking if the Tenda 5G03 device is running the vulnerable firmware version V05.03.02.04 and by testing if the ims_apn parameter in the action_ims_on_with_apn function is susceptible to command injection.

One way to detect exploitation is to look for the presence of the file /tmp/CLTaint_VULN_PROVED on the device, which can be created by sending a crafted HTTP POST request with a malicious ims_apn value such as ';touch /tmp/CLTaint_VULN_PROVED;'.

• Send a crafted HTTP POST request to the vulnerable endpoint with ims_apn parameter set to a command injection payload, for example: ims_apn=;touch /tmp/CLTaint_VULN_PROVED;
• Check the device filesystem for the presence of /tmp/CLTaint_VULN_PROVED to confirm successful command injection.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include updating the Tenda 5G03 device firmware to a version later than V05.03.02.04 where this vulnerability is fixed.

If an update is not immediately available, restrict access to the device's management interface to trusted networks only to prevent exploitation via crafted HTTP requests.

Monitor the device for any suspicious files or activities, such as unexpected files in /tmp/, which may indicate exploitation attempts.

Useful 0 Not Useful 0