CVE-2026-25857 is an OS command injection vulnerability affecting Shenzhen Tenda Technology's Tenda G300-F router firmware version 16.01.14.2 and prior. The vulnerability exists in the WAN diagnostic functionality (formSetWanDiag), where attacker-controlled input is incorporated into a shell command invoking curl without proper sanitization. This allows a remote attacker with management interface access to execute arbitrary commands on the device with elevated privileges. The CVSS 4.0 base score is 8.6, indicating high severity, with network attack vector, low attack complexity, no user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation enables remote attackers with management interface access to execute arbitrary OS commands on the router with the privileges of the management process. This can compromise device integrity, confidentiality, and availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the management interface to trusted networks and users only to reduce exposure. Monitor vendor channels for updates regarding patches or official mitigations.