The vulnerability identified as CVE-2026-38060 affects Tenda 5G03 V05.03.02.04 (Version 1.0). It is a command injection flaw located in the function action_unlock_sim, specifically through the pin parameter. This type of vulnerability can allow an attacker to execute arbitrary system commands on the device, potentially leading to unauthorized control or disruption. The CVE entry does not provide a CVSS score or detailed impact metrics, nor does it include vendor remediation or patch information.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary commands on the affected device, potentially compromising device integrity, confidentiality, and availability. However, no known exploits have been reported in the wild, and the extent of impact depends on the attacker's ability to access the vulnerable function.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the device's management interfaces and monitor for suspicious activity related to the action_unlock_sim function. Avoid exposing the device to untrusted networks or users.