A vulnerability was determined in Tenda AC9 and AC15 15.03.05.14. This affects the function formexeCommand of the file /goform/exeCommand. This manipulation of the argument cmdinput causes os command injection. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized.
Fix
Nothing published yet: no patch, vendor advisory or mitigation reference on NVD, no vendor advisory in the News for this CVE, not in CISA's KEV, no fixed package version. BaselineWatch does not guess at one.
Change history 1
- First seenCVSS 2.1 · tendaNVD modified 2026-10-18 21:10
Affected (CPE criteria) 2
cpe:2.3:o:tenda:ac9_firmware:15.03.05.14:*:*:*:*:*:*:*cpe:2.3:o:tenda:ac15_firmware:15.03.05.14:*:*:*:*:*:*:*
References 7
- https://github.com/2664521593/mycve/blob/main/Tenda/Tenda_AC9_CJ.md Exploit, Third Party Advisory
- https://github.com/2664521593/mycve/blob/main/Tenda/Tenda_AC9_CJ.md#poc Exploit, Third Party Advisory
- https://vuldb.com/?ctiid.323876 Permissions Required
- https://vuldb.com/?id.323876 Third Party Advisory, VDB Entry
- https://vuldb.com/?submit.647838 Third Party Advisory, VDB Entry
- https://vuldb.com/?submit.647839 Third Party Advisory, VDB Entry
- https://www.tenda.com.cn/ Product