This vulnerability affects Tenda G103 firmware version 1.0.0.5. The issue lies in the action_set_net_settings function of the gpon.lua file, where insufficient input validation on several parameters allows remote command injection. Attackers can exploit this by manipulating arguments such as authLoid and authPassword to execute arbitrary commands on the device. The vulnerability has a CVSS 4.0 base score of 5.1, indicating medium severity. Exploit code is publicly available, increasing the risk of exploitation. No vendor patch or advisory is currently referenced.

Successful exploitation allows remote attackers to execute arbitrary commands on the affected device, potentially leading to unauthorized control or disruption of the device's operation. Given the medium CVSS score and remote attack vector with no required user interaction, this vulnerability poses a moderate risk to affected Tenda G103 devices running version 1.0.0.5. There are no known exploits in the wild reported yet, but public exploit code exists.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict remote access to the device’s management interface to trusted networks only. Monitor vendor channels for updates or patches addressing this vulnerability.