Tenda AX3 Command Injection Vulnerability (CNVD-2023-21670)

Tenda Ax3 is an Ax1800 Gigabit port dual-band Wifi 6 wireless router from Tenda (China).Tenda AX3 V16.03.12.11 is vulnerable to command injection, which stems from the failure of the lanip parameter of /goform/AdvSetLanip to properly filter the construct command special characters, commands, etc. The vulnerability can be exploited to cause arbitrary command execution. An attacker could use this vulnerability to cause arbitrary command execution.