Command Injection Vulnerability in Tenda W30E Router
CVE-2022-45506

9.8CRITICAL

Key Information:

Vendor

Tenda
Status
W30e Firmware
Vendor
CVE Published:
8 December 2022

What is CVE-2022-45506?

The Tenda W30E router is vulnerable to a command injection flaw that arises from improper handling of the fileNameMit parameter within the /goform/delFileName endpoint. A malicious actor can exploit this vulnerability to execute arbitrary commands on the affected device, potentially leading to unauthorized file deletions and other detrimental actions against the router’s filesystem.

References

https://github.com/z1r00/IOT_Vul/blob/main/Tenda/W30E/del...

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.