OS Command Injection Vulnerability in Tenda AC18 Router
CVE-2024-2854

6.3MEDIUM

Key Information:

Vendor: Tenda
Status: Ac18
Vendor: CVE Published:; 24 March 2024

Badges

👾 Exploit Exists🟡 Public PoC

Summary

A critical OS command injection vulnerability has been identified in the Tenda AC18 router, specifically within the formSetSambaConf function located in the /goform/setsambacfg file. This vulnerability arises from improper validation of the usbName argument, allowing an attacker to execute arbitrary commands on the router remotely. The vulnerability has been publicly disclosed, increasing the risk of exploitation. Users of the Tenda AC18 are strongly advised to review their configurations and monitor for any suspicious activity. It is worth noting that the vendor was informed about this vulnerability prior to its disclosure but has not issued a response.

Affected Version(s)

AC18 15.03.05.05

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2024-2854 - Proof of Concept