CVE-2023-33530
HighCVSS 8.8Exploitation Probability (EPSS)
Elevated risk67th percentile - higher than 67% of all known CVEs
Summary
A command injection vulnerability exists in the Tenda G103 Gigabit GPON Terminal with firmware version V1.0.0.5. An attacker with web management privileges can inject commands and gain shell access.
Risk Assessment
The risk involves potential full device compromise by an attacker with administrative privileges, leading to network integrity breaches and data leakage.
Recommendation
Immediately update the Tenda G103 firmware to the latest available version and restrict administrative panel access to trusted IP addresses only.
Other vulnerabilities in Tenda G103
See all- CVE-2026-5339Medium
A command injection vulnerability was detected in Tenda G103 1.0.0.5 in the action_set_net_settings function of the gpon.lua file. Remote manipulation of arguments like authLoid leads to arbitrary command execution. The exploit is publicly available.
- CVE-2026-5338Medium
In Tenda G103 1.0.0.5, the action_set_system_settings function in system.lua (Setting Handler component) does not neutralize the lanIp argument, leading to command injection. The attack can be performed remotely and the exploit has been publicly disclosed.
Original NVD description (English source)
There is a command injection vulnerability in the Tenda G103 Gigabit GPON Terminal with firmware version V1.0.0.5. If an attacker gains web management privileges, they can inject commands gaining shell privileges.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS