PatchSiren cyber security CVE debrief

CVE-2026-38060 Tenda CVE debrief

CVE-2026-38060 is a command injection vulnerability in the Tenda 5G03 V05.03.02.04 (Version 1.0). The vulnerability exists in the function action_unlock_sim and is triggered via the pin parameter. This CVE was published on [cvePublishedAt](https://www.cve.org/CVERecord?id=CVE-2026-38060) and last modified on [cveModifiedAt](https://nvd.nist.gov/vuln/detail/CVE-2026-38060).

Vendor: Tenda
Product: 5G03
CVSS: Unknown
CISA KEV: Not listed in stored evidence
Original CVE published: 2026-06-15
Original CVE updated: 2026-06-15
Advisory published: 2026-06-15
Advisory updated: 2026-06-15

Who should care

Users of Tenda 5G03 V05.03.02.04 (Version 1.0) should be aware of this vulnerability and take necessary actions to mitigate the risk.

Technical summary

The vulnerability is caused by improper input validation in the action_unlock_sim function, allowing an attacker to inject malicious commands via the pin parameter.

Defensive priority

High

Recommended defensive actions

Update to a patched version of Tenda 5G03 if available.
Limit access to the action_unlock_sim function.
Monitor for suspicious activity on the device.

Evidence notes

The CVE record [cve-org] and NVD detail [nvd] provide official information about this vulnerability. Additional information can be found at [ref-4].

Official resources

CVE-2026-38060 was published on 2026-06-15T20:16:26.363Z and last modified on 2026-06-15T21:05:18.653Z.