Tenda AC7 Command Injection Vulnerability

Tenda AC7 is a wireless router from Tenda, a Chinese company. A command injection vulnerability exists in Tenda AC7 version 15.03.06.44, which originates from the failure to properly filter the parameter lanIp in the file /goform/AdvSetLanip to construct command special characters, commands, etc...

The vulnerability of the /goform/AdvSetLanip file in the Tenda AC18 microprogramming router software allows a hacker to execute arbitrary commands.

The vulnerability of the /goform/AdvSetLanip file in the Tenda AC18 microprogramming router software is related to the lack of measures for cleaning input data during the processing of the lanIp parameter. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...