CVE-2026-25857

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-25857
Tenda G300-F router firmware version 16.01.14.2 and prior contain an OS command injection vulnerability in the WAN diagnostic functionality (formSetWanDiag). The implementation constructs a shell command that invokes curl and incorporates attacker-controlled input into the command line without adequate neutralization. As a result, a remote attacker with access to the affected management interface can inject additional shell syntax and execute arbitrary commands on the device with the privileges of the management process.

8.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://blog.evan.lat/blog/cve-2026-25857/ Exploit Third Party Advisory
https://www.tendacn.com/material/show/736333682028613 Product
https://www.vulncheck.com/advisories/tenda-g300-f-command-injection-via-formsetwandiag Third Party Advisory VDB Entry
Configurations

Configuration 1 (hide)

AND
cpe:2.3:o:tenda:g300-f_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:tenda:g300-f:1.0:*:*:*:*:*:*:*
History

05 Mar 2026, 20:33

Type Values Removed Values Added
References () https://blog.evan.lat/blog/cve-2026-25857/ - () https://blog.evan.lat/blog/cve-2026-25857/ - Exploit, Third Party Advisory
References () https://www.tendacn.com/material/show/736333682028613 - () https://www.tendacn.com/material/show/736333682028613 - Product
References () https://www.vulncheck.com/advisories/tenda-g300-f-command-injection-via-formsetwandiag - () https://www.vulncheck.com/advisories/tenda-g300-f-command-injection-via-formsetwandiag - Third Party Advisory, VDB Entry
Summary
  • (es) El firmware del router Tenda G300-F, versión 16.01.14.2 y anteriores, contiene una vulnerabilidad de inyección de comandos del sistema operativo en la funcionalidad de diagnóstico WAN (formSetWanDiag). La implementación construye un comando de shell que invoca curl e incorpora entrada controlada por el atacante en la línea de comandos sin una neutralización adecuada. Como resultado, un atacante remoto con acceso a la interfaz de gestión afectada puede inyectar sintaxis de shell adicional y ejecutar comandos arbitrarios en el dispositivo con los privilegios del proceso de gestión.
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 8.8
First Time Tenda
Tenda g300-f
Tenda g300-f Firmware
CPE cpe:2.3:h:tenda:g300-f:1.0:*:*:*:*:*:*:*
cpe:2.3:o:tenda:g300-f_firmware:*:*:*:*:*:*:*:*

10 Feb 2026, 23:16

Type Values Removed Values Added
Summary (en) Tenda G300-F router firmware versio 16.01.14.2 and prior contain an OS command injection vulnerability in the WAN diagnostic functionality (formSetWanDiag). The implementation constructs a shell command that invokes curl and incorporates attacker-controlled input into the command line without adequate neutralization. As a result, a remote attacker with access to the affected management interface can inject additional shell syntax and execute arbitrary commands on the device with the privileges of the management process. (en) Tenda G300-F router firmware version 16.01.14.2 and prior contain an OS command injection vulnerability in the WAN diagnostic functionality (formSetWanDiag). The implementation constructs a shell command that invokes curl and incorporates attacker-controlled input into the command line without adequate neutralization. As a result, a remote attacker with access to the affected management interface can inject additional shell syntax and execute arbitrary commands on the device with the privileges of the management process.

07 Feb 2026, 22:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-02-07 22:16

Updated : 2026-03-05 20:33

NVD link : CVE-2026-25857

Mitre link : CVE-2026-25857

CVE.ORG link : CVE-2026-25857

JSON object : View

Products Affected

tenda

  • g300-f
  • g300-f_firmware
CWE
CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')