Technical impact
The vulnerability resides in the action_set_net_settings function of the gpon.lua script on the Tenda G103 router. Maliciously crafted values for parameters such as authLoid, authLoidPassword, authPassword, authSerialNo, authType, oltType, usVlanId, and usVlanPriority are incorporated directly into a system‑level command without validation, creating a command injection flaw. Successful exploitation allows an attacker to run arbitrary commands on the device and could compromise the entire router.
Affected Systems
Firmware version 1.0.0.5 on the Tenda G103 model is affected. Devices deployed with this firmware and their current configuration are vulnerable until the firmware is corrected by the vendor.
Risk and Exploitability
The CVSS base score of 5.1 places the issue in the medium range, while an EPSS score of 6% indicates a modest probability of exploitation. The vulnerability is not listed in CISA KEV. The description states that the attack can be initiated remotely; based on typical router management interfaces, the likely attack vector is a network request sent to the device from an external or internal source, though the specific protocol (e.g., HTTP) is not explicitly disclosed in the CVE data.
