Remote Command Execution Vulnerability in Tenda PA6 Wi-Fi Powerline Extender
CVE-2019-16213

8.8HIGH

Key Information:

Vendor
Tenda
Status
Pa6 Firmware
Vendor
CVE Published:
25 June 2020

Summary

The Tenda PA6 Wi-Fi Powerline extender version 1.0.1.21 is susceptible to a remote command execution vulnerability. This flaw allows authenticated attackers to inject and execute arbitrary commands on the device by sending a specially crafted string. By manipulating the device name of an attached PLC adapter, attackers can exploit this vulnerability to gain root-level access, potentially compromising the device and the network it connects to. This highlights critical concerns in the security of IoT devices, underlining the necessity for enhanced protective measures.

References

https://securityintelligence.com/posts/vulnerable-powerli...
x_refsource_MISC

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.