Tenda G300-F routers with firmware version 16.01.14.2.2 and any earlier releases are vulnerable to an OS command injection flaw in the WAN diagnostic functionality (formSetWanDiag). The software constructs a shell command that calls curl and incorporates attacker-controlled input without proper sanitization, enabling an attacker to inject arbitrary shell syntax. Successful exploitation grants the attacker full execution rights with the privileges of the device’s management process. This weakness corresponds to CWE-78.

The vulnerability affects devices running the Shenzhen Tenda Technology Tenda G300-F router firmware 16.01.14.2.2 and earlier. The CNA lists the Tenda G300-F router and related firmware variants such as the Tenda RX9 Pro as affected products. Verify the firmware version on any Tenda G300-F or RX9 Pro devices to determine exposure.

The CVSS score of 8.6 indicates a high severity risk, while the EPSS score of less than 1% reflects a low current exploitation probability. The vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is remote access to the router’s management interface; an attacker who can reach the web-based interface—either locally or over the network—can supply malicious input to formSetWanDiag. Based on the description, it is inferred that the attacker does not need additional privileges beyond access to the management interface. Successful exploitation would allow the attacker to execute arbitrary commands with elevated privileges, potentially compromising the entire device and any devices behind it.