CVE-2023-36103 is a critical (9.8) command injection flaw in the goform/SetIPTVCfg web interface of Tenda AC15 routers running firmware V15.03.05.20. The record says remote attackers can run commands with a crafted request. I could not confirm a vendor fix, so reduce exposure and check Tenda's support pages.
What's affected
The record lists Tenda AC15 firmware V15.03.05.20, with the AC15 hardware as the platform. That is the one version it names.
There is no vendor advisory in the record. The only reference is a short note on GitHub from a researcher, which names the same firmware build and the SetIPTVCfg interface. It also says the issue can be combined with an older flaw, CVE-2021-44971, to achieve what it calls unconditional arbitrary command execution. I read the note, and it contains no fixed version.
Because of that, I cannot tell you which firmware release fixes it, or whether one exists. Check Tenda's support and download pages for your exact model and hardware revision, and read the release notes of anything newer than V15.03.05.20 before you assume it helps.
How to check if you're exposed
Check the firmware version on each AC15 and see whether the router's management page is reachable from places it should not be.
- Sign in to the router's admin page from inside your network.
- Open the system status or firmware page and read the firmware version. V15.03.05.20 is the affected build named in the record.
- Check whether remote web management is turned on. If it is, the admin page may be reachable from the internet.
- From outside your network, for example on mobile data, check whether the router's admin address answers. Only do this against your own device.
For a fleet, your router inventory or a network scan of your own address space can show which models answer on the web admin port. Do not probe addresses that are not yours.
What to do now
- Find every Tenda AC15 you operate, including ones at home offices and small sites, and record the firmware version.
- Turn off remote web management so the admin page is only reachable from the local network.
- Look for a newer firmware on Tenda's support page for your model and hardware revision. If one exists, read its release notes, then apply it.
- Change the router admin password to a long unique one, and make sure guests and IoT devices cannot reach the admin page.
- Keep the router's management interface off any shared or untrusted segment.
- If Tenda offers no fix and the model is out of support, replace it. A router with a known critical flaw and no patch is a standing risk.
Why it matters
The weakness is CWE-77, command injection. A web form handler takes a value from a request and passes it to the operating system in a way that lets the sender add commands of their own. On a router that usually means the commands run with the router's own high privileges.
The record rates it 9.8 because it is reachable over the network, needs no privileges and no user interaction, and gives high impact. The score assumes the attacker can reach the admin interface. That is why turning off remote management matters. It does not remove the bug, but it removes the easy route to it.
It is not in CISA's Known Exploited Vulnerabilities catalogue, and the note I read does not claim exploitation in the wild. I am not reproducing the request details. Small office routers are a repeated source of this class of flaw, and the same few weaknesses show up across vendors.
Quick check
Which firmware fixes this?
I could not confirm one. The record names only the affected build, V15.03.05.20, and has no vendor advisory. Check Tenda's support pages.
Does turning off remote management fix it?
No. It reduces who can reach the vulnerable interface, but the flaw remains in the firmware.
Sources
Last reviewed: 19 October 2026.
