CVE-2026-38063: Command Injection

Affected Software

Remediation

Recommended actions to resolve this vulnerability, in priority order.

1. Remove

   Remove Tenda 5G03 V05.03.02.04 (Version 1.0) from your environment.

   Remove or replace devices running Tenda 5G03 V05.03.02.04 (Version 1.0). Take affected devices offline or replace with non-vulnerable hardware/firmware until a vendor-provided fix is available.

2. Configuration

   Disable remote management and any configurable service interfaces that accept the 'ia' parameter (or otherwise expose action_radio_on_with_ia_apn) to reduce exposure. If a specific setting to disable the vulnerable functionality exists, disable it.

   Tenda 5G03 device management / affected service remote_management / accept_ia_parameter = disabled
3. Compensating control

   Apply network-level restrictions: restrict access to the device to trusted IP addresses via firewall/ACLs, isolate the device on a management VLAN, and block or rate-limit inbound requests that include the 'ia' parameter. Deploy WAF/IDS rules to detect and block command-injection attempts targeting action_radio_on_with_ia_apn.

4. Operational

   Monitor device logs and network traffic for attempts referencing the 'ia' parameter or action_radio_on_with_ia_apn. Keep affected devices offline or otherwise isolated until a vendor-supplied firmware update is provided and applied.

Event History

Frequently Asked Questions