CVE-2026-5339
Published: 02 April 2026
Summary
CVE-2026-5339 is a medium-severity Injection (CWE-74) vulnerability in Tenda G103 Firmware. Its CVSS base score is 4.7 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Network Device CLI (T1059.008); ranked at the 44.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-10 (Information Input Validation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly prevents command injection by requiring validation of vulnerable arguments (authLoid, authLoidPassword, etc.) passed to the action_set_net_settings function in gpon.lua.
Requires timely identification, reporting, and remediation of the specific command injection flaw in Tenda G103 firmware version 1.0.0.5.
Enables detection of CVE-2026-5339 through vulnerability monitoring and scanning of the affected Setting Handler component.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Command injection vulnerability in network device firmware web handler directly enables Network Device CLI execution (T1059.008) and exploitation of a remote service (T1210).
NVD Description
A vulnerability was detected in Tenda G103 1.0.0.5. The impacted element is the function action_set_net_settings of the file gpon.lua of the component Setting Handler. Performing a manipulation of the argument authLoid/authLoidPassword/authPassword/authSerialNo/authType/oltType/usVlanId/usVlanPriority results in command injection. It is possible to initiate…
more
the attack remotely. The exploit is now public and may be used.
Deeper analysisAI
CVE-2026-5339 is a command injection vulnerability in Tenda G103 firmware version 1.0.0.5. The affected component is the Setting Handler, specifically the action_set_net_settings function in the gpon.lua file. The flaw arises from improper handling of arguments including authLoid, authLoidPassword, authPassword, authSerialNo, authType, oltType, usVlanId, and usVlanPriority, enabling injection of malicious commands.
Remote attackers with high privileges can exploit this vulnerability over the network with low complexity and no user interaction required. Successful exploitation grants limited impacts on confidentiality, integrity, and availability, as reflected in the CVSS v3.1 base score of 4.7 (AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L). Associated CWEs are CWE-74 (Improper Neutralization of Special Elements) and CWE-77 (Command Injection).
VulDB entries (submissions 781132 through 781135) document the vulnerability, while a public exploit is available on GitHub at https://github.com/ZZ2266/.github.io/tree/main/Tenda%20G103/authLoid. No vendor patches or specific mitigation guidance are detailed in the references. The exploit is public and may be used in attacks.
Details
- CWE(s)