Vulnerability · Published Feb 7, 2026 · Assigned by VulnCheck
CVE-2026-25857Tenda G300-F Command Injection via formSetWanDiag
High 8.6
In plain English
A high-severity OS command injection in Tenda G300-F from Shenzhen Tenda Technology. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 3.1% (higher than 88% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.
Official description
Tenda G300-F router firmware version 16.01.14.2 and prior contain an OS command injection vulnerability in the WAN diagnostic functionality (formSetWanDiag). The implementation constructs a shell command that invokes curl and incorporates attacker-controlled input into the command line without adequate neutralization. As a result, a remote attacker with access to the affected management interface can inject additional shell syntax and execute arbitrary commands on the device with the privileges of the management process.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Shenzhen Tenda Technology | Tenda G300-F | 0 – through 16.01.14.2 |
Weakness: CWE-78 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
References
- https://blog.evan.lat/blog/cve-2026-25857/ technical-description, exploit
- https://www.tendacn.com/material/show/736333682028613 product
- https://www.vulncheck.com/advisories/tenda-g300-f-command-injection-via-formsetwandiag third-party-advisory