CVE-2026-5338 | Tenda G103 1.0.0.5 Setting system.lua action_set_system_settings lanIp command injection

A vulnerability was found in Tenda G103 1.0.0.5. It has been declared as critical. The affected element is the function action_set_system_settings of the file system.lua of the component Setting Handler. Such manipulation of the argument lanIp leads to command injection.

This vulnerability is listed as CVE-2026-5338. The attack may be performed from remote. In addition, an exploit is available.