Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Tenda G300-F router firmware version 16.01.14.2 and prior contain an OS command injection vulnerability in the WAN diagnostic functionality (formSetWanDiag). The implementation constructs a shell command that invokes curl and incorporates attacker-controlled input into the command line without adequate neutralization. As a result, a remote attacker with access to the affected management interface can inject additional shell syntax and execute arbitrary commands on the device with the privileges of the management process.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
1 version affected across 2 products
| Date | Total | Labels |
|---|
| 2026-02-07 | 1 | Disclosure1 |
| 2026-02-08 | 1 | Patch1 |
CVE-2026-25857 Tenda G300-F router firmware versio 16.01.14.2 and prior contain an OS command injection vulnerability in the WAN diagnostic functionality (formSetWanDiag). The imple… https://www.cve.org/CVERecord?id=CVE-2026-25857
Post summary
CVE-2026-25857 reveals an OS command injection flaw in Tenda G300‑F routers’ WAN diagnostic feature, allowing attackers to execute arbitrary commands via the formSetWanDiag endpoint.
🚨 High-severity OS command injection (CVSS 8.6) in Tenda G300-F routers could allow remote takeover if management access is exposed. No patch yet — restrict access & monitor closely! https://radar.offseq.com/threat/cve-2026-25857-cwe-78-improper-neutralization-of-s-97d5f696 #O... https://t.co/N1U869EVMh
Post summary
A high‑severity OS command injection in Tenda G300‑F routers is disclosed without a patch yet; users should restrict management access and monitor for exploitation.
2 of 2 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| HW | tenda | g300-f | 1.0 | - | - |
| OS | tenda | g300-f_firmware | - | - | - |