The Tenda 5G03 device running version V05.03.02.04 (Version 1.0) is affected by a command injection vulnerability identified as CVE-2026-38065. The vulnerability exists in the function action_ims_on_with_apn where the ims_apn parameter is not properly sanitized, allowing remote attackers to inject and execute arbitrary commands. The CVSS v3.1 base score is 9.8, indicating critical severity with network attack vector, low attack complexity, no privileges or user interaction required, and impacts on confidentiality, integrity, and availability. There is no vendor advisory or patch information available at this time.

Successful exploitation of this vulnerability could allow unauthenticated remote attackers to execute arbitrary commands on the affected device, potentially leading to full system compromise, data theft, service disruption, and unauthorized control over the device. The CVSS score of 9.8 reflects critical impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict network access to the device to trusted sources only and monitor for suspicious activity related to the ims_apn parameter. Do not expose the device management interfaces to untrusted networks.