CVE-2026-38061 describes a command injection vulnerability in Tenda 5G03 firmware version V05.03.02.04 (Version 1.0). The flaw exists in the action_set_volume function where the volume parameter is not properly sanitized, enabling remote attackers to execute arbitrary system commands without authentication. The vulnerability has a CVSS 3.1 base score of 9.8, indicating critical severity with network attack vector, low attack complexity, no privileges or user interaction required, and full impact on confidentiality, integrity, and availability. No known exploits are reported in the wild, and no official patch or remediation level has been disclosed.

Successful exploitation of this vulnerability could allow remote attackers to execute arbitrary commands on the affected device, potentially leading to full system compromise, data theft, service disruption, or further network penetration. The CVSS score of 9.8 reflects critical impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict network access to the device, especially from untrusted sources, and monitor for suspicious activity related to the volume parameter. Avoid exposing the device to the internet or untrusted networks.