CVE-2026-38064: Command Injection
Tenda 5G03 V05.03.02.04 (Version 1.0) is vulnerable to Command injection in the function actiondialcall via the dialNumber parameter.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Restrict access to the Tenda 5G03 (V05.03.02.04) management interfaces (web/remote) to trusted IP addresses via firewall rules or ACLs to prevent unauthenticated/remote access to the action_dial_call endpoint.
- Compensating control
Disable remote management and/or place the Tenda 5G03 (V05.03.02.04) on a segmented management network (no access from untrusted networks); block access to any endpoints that accept the dialNumber parameter until an official vendor fix is available.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-38064?
CVE-2026-38064 has a critical severity level of 9.8 according to the CVSS 3.1 score.
How do I fix CVE-2026-38064?
To fix CVE-2026-38064, update the Tenda 5G03 firmware to the latest version provided by the manufacturer.
What type of vulnerability is CVE-2026-38064?
CVE-2026-38064 is a command injection vulnerability affecting the action_dial_call function.
What devices are affected by CVE-2026-38064?
CVE-2026-38064 affects Tenda 5G03 routers running version 1.0 firmware.
What are the potential impacts of CVE-2026-38064?
The potential impacts of CVE-2026-38064 include unauthorized command execution and complete system compromise.