Remote Command Injection Vulnerability in Tenda AC1206 Router

CVE-2024-9793

Summary

A severe vulnerability has been identified in Tenda's AC1206 router affecting all versions up to 15.03.06.23. This security flaw resides in the ate_iwpriv_set and ate_ifconfig_set functions located in the /goform/ate file, enabling attackers to perform command injection. Given the nature of this vulnerability, it can be exploited remotely, allowing unauthorized users to execute harmful commands that may lead to the compromise of the router's functionality and security. Despite early disclosure of the vulnerability to Tenda, no response or remediation has been provided by the vendor, raising concerns over user safety. It is crucial for users of the affected devices to take immediate action to mitigate the risks associated with this vulnerability.

References