CVE-2026-38064 describes a command injection vulnerability in Tenda 5G03 V05.03.02.04 (Version 1.0). The flaw exists in the action_dial_call function where the dialNumber parameter is not properly sanitized, enabling remote attackers to inject and execute arbitrary commands. The vulnerability has a CVSS 3.1 base score of 9.8, indicating critical severity with network attack vector, no required privileges or user interaction, and impacts on confidentiality, integrity, and availability. No vendor advisory or patch information is available at this time.

Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to execute arbitrary commands on the affected device, potentially leading to full system compromise, data theft, service disruption, or further network penetration. The high CVSS score reflects the critical nature and broad impact of this issue.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict network access to the affected device, especially from untrusted networks, and monitor for suspicious activity related to the dialNumber parameter. Avoid exposing the vulnerable interface to the internet.