Tenda AC10 OS Command Injection Vulnerability (CNVD-2024-15743)

2024-03-2200:00:00

China National Vulnerability Database

www.cnvd.org.cn

tenda ac10u

wireless router

chinese company

command injection

vulnerability

mac parameter

formwritefacmac function

/goform/writefacmac file

arbitrary command execution

AI Score

7.6

Confidence

High

EPSS

0.001

Percentile

16.3%

JSON

The Tenda AC10 is a wireless router from the Chinese company Tenda. Tenda AC10U version 15.03.06.49 suffers from an operating system command injection vulnerability, which originates from the mac parameter of the formWriteFacMac function of the /goform/WriteFacMac file failing to correctly filter the constructor command special characters, commands, and so on. An attacker can exploit this vulnerability to cause arbitrary command execution.