Description
Tenda G300-F router firmware version 16.01.14.2 and prior contain an OS command injection vulnerability in the WAN diagnostic functionality (formSetWanDiag). The implementation constructs a shell command that invokes curl and incorporates attacker-controlled input into the command line without adequate neutralization. As a result, a remote attacker with access to the affected management interface can inject additional shell syntax and execute arbitrary commands on the device with the privileges of the management process.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Shenzhen Tenda Technology | Tenda G300-F | ≤ 16.01.14.2 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 1 repository
-
eeeeeeeeeevan/CVE-2026-25857 ★ 1 · Feb 12, 2026
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- https://blog.evan.lat/blog/cve-2026-25857/ technical-description exploit
- https://www.tendacn.com/material/show/736333682028613 product
- https://www.vulncheck.com/advisories/tenda-g300-f-command-injection-via-formsetwandiag third-party-advisory