PatchSiren cyber security CVE debrief

CVE-2026-38064 Tenda CVE debrief

CVE-2026-38064 is a command injection vulnerability in the Tenda 5G03 V05.03.02.04 (Version 1.0). The vulnerability exists in the function action_dial_call via the dialNumber parameter. This CVE was published on [cvePublishedAt](https://www.cve.org/CVERecord?id=CVE-2026-38064) and last modified on [cveModifiedAt](https://nvd.nist.gov/vuln/detail/CVE-2026-38064).

Vendor: Tenda
Product: 5G03
CVSS: Unknown
CISA KEV: Not listed in stored evidence
Original CVE published: 2026-06-15
Original CVE updated: 2026-06-15
Advisory published: 2026-06-15
Advisory updated: 2026-06-15

Who should care

Users of Tenda 5G03 V05.03.02.04 (Version 1.0) should be aware of this vulnerability and take necessary actions to mitigate the risk.

Technical summary

The vulnerability is caused by improper input validation in the action_dial_call function, allowing an attacker to inject malicious commands via the dialNumber parameter.

Defensive priority

High

Recommended defensive actions

Update to a patched version of Tenda 5G03 if available.
Limit access to the affected function action_dial_call.
Monitor for suspicious activity related to the dialNumber parameter.

Evidence notes

The CVE record [cve-org] and NVD detail [nvd] provide official information about this vulnerability. Additional information can be found at [ref-4].

Official resources

CVE-2026-38064 was published on 2026-06-15T20:16:26.790Z and last modified on 2026-06-15T21:05:18.653Z.