CVE-2024-2812

A vulnerability was found in Tenda AC15 15.03.05.18/15.03.20_multi. It has been classified as critical. This affects the function formWriteFacMac of the file /goform/WriteFacMac. The manipulation of the argument mac leads to os command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-257667. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Configurations

Configuration 1 (hide)

AND
OR cpe:2.3:o:tenda:ac15_firmware:15.03.05.18:*:*:*:*:*:*:*
cpe:2.3:o:tenda:ac15_firmware:15.03.05.20_multi:*:*:*:*:*:*:*
cpe:2.3:h:tenda:ac15:1.0:*:*:*:*:*:*:*

History

26 Mar 2024, 03:14

Type Values Removed Values Added
First Time Tenda ac15 Firmware
Tenda
Tenda ac15
References () https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/AC15/V1.0%20V15.03.20_multi/formWriteFacMac.md - () https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/AC15/V1.0%20V15.03.20_multi/formWriteFacMac.md - Exploit, Third Party Advisory
References () https://vuldb.com/?ctiid.257667 - () https://vuldb.com/?ctiid.257667 - Permissions Required
References () https://vuldb.com/?id.257667 - () https://vuldb.com/?id.257667 - Third Party Advisory
CVSS v2 : 6.5
v3 : 6.3
v2 : 6.5
v3 : 8.8
Summary
  • (es) Se encontró una vulnerabilidad en Tenda AC15 15.03.05.18/15.03.20_multi. Ha sido clasificada como crítica. Esto afecta a la función formWriteFacMac del archivo /goform/WriteFacMac. La manipulación del argumento mac conduce a la inyección de comandos del sistema operativo. Es posible iniciar el ataque de forma remota. El exploit ha sido divulgado al público y puede utilizarse. El identificador asociado de esta vulnerabilidad es VDB-257667. NOTA: Se contactó primeramente con el proveedor sobre esta divulgación, pero no respondió de ninguna manera.
CPE cpe:2.3:o:tenda:ac15_firmware:15.03.05.18:*:*:*:*:*:*:*
cpe:2.3:o:tenda:ac15_firmware:15.03.05.20_multi:*:*:*:*:*:*:*
cpe:2.3:h:tenda:ac15:1.0:*:*:*:*:*:*:*

22 Mar 2024, 07:15

Type Values Removed Values Added
New CVE

Information

Published : 2024-03-22 07:15

Updated : 2024-05-17 02:38


NVD link : CVE-2024-2812

Mitre link : CVE-2024-2812

CVE.ORG link : CVE-2024-2812


JSON object : View

Products Affected

tenda

  • ac15_firmware
  • ac15
CWE
CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')