This vulnerability involves command injection in the Tenda G103 router firmware version 1.0.0.5. Specifically, the action_set_system_settings function in system.lua improperly sanitizes the lanIp parameter, enabling remote attackers to execute arbitrary commands on the device. The vulnerability is remotely exploitable without user interaction and has a CVSS 4.0 base score of 5.1, indicating medium severity. Public disclosure of the exploit exists, but no evidence of active exploitation has been reported. No vendor advisory or patch information is currently available.

Successful exploitation could allow an attacker with high privileges to execute arbitrary commands on the affected device remotely. This could lead to unauthorized control or disruption of the router's operation. However, the CVSS vector indicates that the attack requires high privileges, limiting the ease of exploitation. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, limit remote access to the affected device and monitor for unusual activity. Avoid exposing the device management interface to untrusted networks. Follow vendor communications closely for updates on patches or mitigations.