Tenda G103 vulnerabilities

A command injection vulnerability was detected in Tenda G103 1.0.0.5 in the action_set_net_settings function of the gpon.lua file. Remote manipulation of arguments like authLoid leads to arbitrary command execution. The exploit is publicly available.

In Tenda G103 1.0.0.5, the action_set_system_settings function in system.lua (Setting Handler component) does not neutralize the lanIp argument, leading to command injection. The attack can be performed remotely and the exploit has been publicly disclosed.

A command injection vulnerability exists in the Tenda G103 Gigabit GPON Terminal with firmware version V1.0.0.5. An attacker with web management privileges can inject commands and gain shell access.