The Tenda G300-F routers running firmware version 16.01.14.2 and earlier have a command injection flaw in the formSetWanDiag WAN diagnostic functionality. When a user submits the form, the firmware builds a shell command that calls curl and embeds attacker-controlled data without proper sanitization. This allows a remote attacker who can reach the router’s web‑based management interface to inject arbitrary shell syntax and execute commands with the privileges of the device’s management process. The weakness corresponds to CWE‑78.

The vulnerability affects Shenzhen Tenda Technology Tenda G300‑F routers with firmware version 16.01.14.2 and earlier. Only the Tenda G300‑F device is listed in the vendor/product information; no other Tenda models are provided.

The CVSS score of 8.6 indicates a high severity, while the EPSS score of 3 % indicates a low current exploitation probability. The vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is remote access to the router’s management interface; an attacker who can reach the web-based interface can supply malicious input, and does not need additional privileges beyond that interval. Successful exploitation would grant the attacker arbitrary command execution on the device with elevated privileges, potentially compromising the entire device and any devices it serves.