Remote Code Execution Vulnerability in Tenda AC5 Router
CVE-2023-31587

9.8CRITICAL

Key Information:

Vendor
Tenda
Status
Ac5 Firmware
Vendor
CVE Published:
16 May 2023

Summary

The Tenda AC5 router, specifically version V15.03.06.28, contains a vulnerability that allows an attacker to execute arbitrary code remotely via the Mac parameter at the ip/goform/WriteFacMac endpoint. This flaw could potentially allow unauthorized access to the device, leading to a compromise of network integrity and user data. Users are advised to apply necessary security measures and updates to safeguard against potential exploitation.

References

https://www.tenda.com.cn/product/AC5.html
https://www.tenda.com.cn/download/detail-2740.html
https://github.com/yanbushuang/CVE/blob/main/TendaAC5.md

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.