CVE-2026-38060: Command Injection
Tenda 5G03 V05.03.02.04 (Version 1.0) is vulnerable to Command injection in the function actionunlocksim via the pin parameter.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
If the device firmware or management interface allows, disable the action_unlock_sim endpoint/functionality to prevent processing of the pin parameter.
Tenda 5G03 web/API management action_unlock_sim = disabled - Compensating control
Restrict access to the device management interface that exposes action_unlock_sim (for example: disable remote administration, firewall the management ports, limit access to trusted IPs/VLANs) until a vendor firmware fix is available.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-38060?
The severity of CVE-2026-38060 is critical with a CVSS score of 9.8.
What does CVE-2026-38060 exploit?
CVE-2026-38060 exploits a command injection vulnerability in the action_unlock_sim function via the pin parameter.
How do I fix CVE-2026-38060?
To fix CVE-2026-38060, update Tenda 5G03 to the latest firmware version where the vulnerability is addressed.
What are the potential impacts of CVE-2026-38060?
The potential impacts of CVE-2026-38060 include unauthorized command execution, leading to possible data breaches or system compromise.
Is CVE-2026-38060 specific to certain versions of Tenda hardware?
Yes, CVE-2026-38060 specifically affects Tenda 5G03 running version V05.03.02.04.