CVE-2017-16923

🗓️ 21 Nov 2017 14:00:00Reported by mitreType

cve

cve🔗 web.nvd.nist.gov👁 54 Views🌐 WEB

Command Injection vulnerability in Shenzhen Tenda AC9, AC15, and AC18 devices allows remote attackers to execute arbitrary OS commands via crafted GET request. NV

Reporter	Title	Published	Views	Family All 6
CNVD	Multiple Shenzhen Tenda Products app_data_center Command Injection Vulnerabilities	22 Nov 201700:00	–	cnvd
Cvelist	CVE-2017-16923	21 Nov 201714:00	–	cvelist
EUVD	EUVD-2017-8093	7 Oct 202500:30	–	euvd
NVD	CVE-2017-16923	21 Nov 201714:29	–	nvd
Prion	Command injection	21 Nov 201714:29	–	prion
RedhatCVE	CVE-2017-16923	22 May 202509:08	–	redhatcve

NVD

Node

tenda ac9_firmwareMatchus_ac9v1.0br_v15.03.05.14_multi_td01

AND

tenda ac9Match-

Node

tenda ac9_firmwareMatchac9_kf_v15.03.05.19(6318_)_cn

AND

tenda ac9Match-

Node

tenda ac15_firmwareMatchus_ac15v1.0br_v15.03.05.18_multi_td01

AND

tenda ac15Match-

Node

tenda ac15_firmwareMatchus_ac15v1.0br_v15.03.05.19_multi_td01

AND

tenda ac15Match-

Node

tenda ac18_firmwareMatchus_ac18v1.0br_v15.03.05.05_multi_td01

AND

tenda ac18Match-

Node

tenda ac18_firmwareMatchac18_kf_v15.03.05.19(6318_)_cn

AND

tenda ac18Match-

Source	Link
github	www.github.com/Iolop/Poc/tree/master/Router/Tenda

Parameter	Position	Path	Description	CWE
dev_name	query param	/cgi-bin/luci/usbeject	Command injection via crafted GET parameter dev_name in usbeject endpoint.	CWE-78

13 May 2026 00:24Current

9.1High risk

Vulners AI Score9.1

CVSS 28.3

CVSS 38.8

EPSS0.03467

cve-2017-16923 command injection vulnerability shenzhen tenda ac9 ac15 ac18 remote attack os commands cgi-bin lan