A vulnerability exists in the firmware of the Tenda G103 router where the action_set_net_settings function in the gpon.lua script incorporates user supplied configuration values into a shell command without proper validation. Based on the description, this flaw could allow an attacker to insert arbitrary commands into the request arguments and have them executed on the device. The exploit can be triggered remotely via a network connection to the router's management interface.

The V1.0.0.5 firmware of the Tenda G103 model is affected. This device is commonly deployed in residential and small‑business environments. Any unit running the listed firmware build remains vulnerable until a newer firmware version is installed.

The CVSS base score of 5.1 places the issue in the medium range, while the EPSS score of less than 1% suggests a low probability of exploitation under current market data. The vulnerability is not listed in the CISA KEV catalog. Attackers would need to send a crafted HTTP request from an external or internal network to the router to trigger the command injection. Although the likelihood of exploitation appears low, the impact of successful exploitation could include unintended command execution on the device, potentially allowing further compromise or persistence.