OS Command Injection Vulnerability in Tenda AC18 Router
CVE-2024-2854
6.3MEDIUM
What is CVE-2024-2854?
A critical OS command injection vulnerability has been identified in the Tenda AC18 router, specifically within the formSetSambaConf function located in the /goform/setsambacfg file. This vulnerability arises from improper validation of the usbName argument, allowing an attacker to execute arbitrary commands on the router remotely. The vulnerability has been publicly disclosed, increasing the risk of exploitation. Users of the Tenda AC18 are strongly advised to review their configurations and monitor for any suspicious activity. It is worth noting that the vendor was informed about this vulnerability prior to its disclosure but has not issued a response.
Affected Version(s)
AC18 15.03.05.05
References
CVSS V3.1
Score:
6.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged
Timeline
- 👾
Exploit known to exist
Vulnerability published
Vulnerability Reserved
Credit
wxhwxhwxh_miemie (VulDB User)