This vulnerability affects the Tenda 4G300 router firmware US_4G300V1.0Mt_V1.01.42_CN_TDC01. It arises from improper handling of the 'delflag' parameter in the /goform/DelFil endpoint, specifically in the sub_425A28 function, enabling remote command injection. The vulnerability requires no user interaction and can be exploited over the network with low attack complexity. The CVSS 4.0 vector indicates network attack vector, low complexity, no privileges required, no user interaction, and low impact on confidentiality, integrity, and availability. No official patch or remediation guidance is currently available from the vendor, and the vulnerability is not related to a cloud service.

Successful exploitation allows an attacker to execute arbitrary commands remotely on the affected device, potentially leading to unauthorized control or disruption of the router's operation. The impact on confidentiality, integrity, and availability is rated low, consistent with the CVSS vector. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider limiting network exposure of the affected device and monitor for unusual activity. No vendor-provided mitigation or temporary fix is currently documented.