CVE-2026-38062 describes a command injection vulnerability in Tenda 5G03 firmware version V05.03.02.04. The flaw exists in the action_set_rat_mode function where the ratMode parameter is not properly sanitized, enabling remote attackers to execute arbitrary system commands. The vulnerability has a CVSS 3.1 base score of 9.8, indicating critical severity with network attack vector, low attack complexity, no privileges or user interaction required, and full impact on confidentiality, integrity, and availability. No vendor advisory or patch information is available at this time.

Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to execute arbitrary commands on the affected device, potentially leading to full system compromise, data theft, service disruption, or further network penetration. The critical CVSS score reflects the high risk and potential severe consequences.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to the affected device, especially from untrusted networks, to reduce exposure. Monitor for unusual activity related to the vulnerable function. Avoid exposing the device management interface to the internet.