Tenda · AC7, AC9, and AC10 Routers

CVE-2018-14558

Tenda AC7, AC9, and AC10 Routers Command Injection Vulnerability

Exploited in attacks Critical 9.8 Attack chance: 8.5%

What it is

An issue was discovered on Tenda AC7 devices with firmware through V15.03.06.44_CN(AC7), AC9 devices with firmware through V15.03.05.19(6318)_CN(AC9), and AC10 devices with firmware through V15.03.06.23_CN(AC10). A command Injection vulnerability allows attackers to execute arbitrary OS commands via a crafted goform/setUsbUnload request. This occurs because the "formsetUsbUnload" function executes a dosystemCmd function with untrusted input.

CISA: Tenda AC7, AC9, and AC10 devices contain a command injection vulnerability due to the "formsetUsbUnload" function executes a dosystemCmd function with untrusted input. Successful exploitation allows an attacker to execute OS commands via a crafted goform/setUsbUnload request.

What to do

Apply updates per vendor instructions.

Deadline for US federal agencies: May 3, 2022

Added to the CISA list: November 3, 2021
Published: October 30, 2018
Severity: Critical 9.8 CVSS 3.1
Chance of attacks in the next 30 days (EPSS): 8.5% in the top 5.0% of all known vulnerabilities
Weakness: CWE-78
More details: NVD · CVE.org · CISA

All references (1)

https://github.com/zsjevilhex/iot/blob/master/route/tenda/tenda-01/Tenda.md

More exploited flaws from Tenda

Added	Vulnerability	Product	Severity	Attack chance
Nov 3, 2021	Remote Code ExecutionCVE-2020-10987	AC1900 Router AC15 Model	Critical 9.8	80%
Nov 3, 2021	Stack Buffer OverflowCVE-2021-31755	AC11 Router	Critical 9.8	87%

All of them →

Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.