High-severity command injection vulnerabilities (CVE-2025-13207 and CVE-2024-24481, CVSS 8.8) have been discovered in Tenda’s N300 Wi-Fi 4G LTE Router and 4G03 Pro model, affecting firmware versions up to v04.03.01.44 and v04.03.01.14, respectively. Authenticated attackers can exploit these flaws via crafted HTTP requests (TCP ports 80 or 7329) to execute arbitrary commands with root privileges, granting full control over the device. This enables interception of network traffic, router configuration manipulation, persistent backdoor establishment, or pivoting attacks into connected networks.No vendor patches or mitigations are available, leaving users exposed. The vulnerabilities stem from improper input handling in internal service functions, discovered via firmware reverse engineering. Successful exploitation risks complete device compromise, turning routers into attack launchpads for broader network infiltration. Security experts urge users to discontinue use or deploy alternative solutions to prevent potential breaches, data interception, or lateral movement by threat actors. The lack of fixes exacerbates risks for individuals and organizations relying on these devices for mobile or temporary networking.