OS Command Injection Vulnerability in Tenda AC18 Router
CVE-2024-2854

6.3MEDIUM

Key Information:

Vendor

Tenda
Status
Ac18
Vendor
CVE Published:
24 March 2024

Badges

👾 Exploit Exists

What is CVE-2024-2854?

A critical OS command injection vulnerability has been identified in the Tenda AC18 router, specifically within the formSetSambaConf function located in the /goform/setsambacfg file. This vulnerability arises from improper validation of the usbName argument, allowing an attacker to execute arbitrary commands on the router remotely. The vulnerability has been publicly disclosed, increasing the risk of exploitation. Users of the Tenda AC18 are strongly advised to review their configurations and monitor for any suspicious activity. It is worth noting that the vendor was informed about this vulnerability prior to its disclosure but has not issued a response.

Affected Version(s)

AC18 15.03.05.05

References

https://vuldb.com/?id.257778
vdb-entrytechnical-description
https://vuldb.com/?ctiid.257778
signaturepermissions-required
https://github.com/abcdefg-png/IoT-vulnerable/blob/main/T...
exploit

CVSS V3.1

Score:
6.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

wxhwxhwxh_miemie (VulDB User)
.