CVE-2026-5339 | Tenda G103 1.0.0.5 Setting gpon.lua action_set_net_settings command injection

A vulnerability was found in Tenda G103 1.0.0.5. It has been rated as critical. The impacted element is the function action_set_net_settings of the file gpon.lua of the component Setting Handler. Performing a manipulation of the argument authLoid/authLoidPassword/authPassword/authSerialNo/authType/oltType/usVlanId/usVlanPriority results in command injection.

This vulnerability is cataloged as CVE-2026-5339. It is possible to initiate the attack remotely. Furthermore, there is an exploit available.