The vulnerability resides in the action_set_system_settings function within the system.lua script of the Tenda G103 router. By manipulating the lanIp parameter, an attacker can inject shell commands, enabling remote execution of arbitrary code. This weakness is classified under CWE-74 and CWE-77 and can lead to full compromise of the device, affecting confidentiality, integrity, and availability. The CVSS score of 5.1 reflects moderate severity due to the need for network access and the potential for severe impact.

Affected product is the Tenda G103 wireless router running firmware version 1.0.0.5. Only this specific firmware build is known to contain the vulnerable action_set_system_settings function. Users of earlier or later builds are not known to be impacted.

The publicly disclosed exploit may be executed from a remote network location, and the EPSS score indicates low probability of widespread exploitation. The vulnerability is not listed in the CISA KEV catalog, suggesting limited known active attacks. However, because the flaw allows arbitrary command execution and requires only remote network access, the risk remains significant for exposed routers. Administrators should treat this as a high priority to mitigate potential compromise.