PT-2022-18204 · Tenda · Tenda M3

Name of the Vulnerable Software and Affected Versions: Tenda M3 version 1.10 V1.0.0.124856 Description: A command injection issue was found in the component "/goform/delAd" of the affected software. Recommendations: For version 1.10 V1.0.0.124856, consider restricting access to the "/goform/delAd...

CVE-2022-27082: Improper Neutralization of Special Elements used in a Command

Tenda M3 1.10 V1.0.0.124856 was discovered to contain a command injection vulnerability via the component /goform/SetInternetLanInfo...

CVE-2022-27079: Improper Neutralization of Special Elements used in a Command

Tenda M3 1.10 V1.0.0.124856 was discovered to contain a command injection vulnerability via the component /goform/setPicListItem...

Tenda M3 操作系统命令注入漏洞

Tenda M3 is an access control from Tenda, a Chinese company. Tenda M3 has a command injection vulnerability, which originates from the component /goform/exeCommand fails to properly filter the construction of command special characters, commands, etc., which can be exploited by attackers to cause...

Tenda M3 命令注入漏洞

Tenda M3 is an access control from Tenda, a Chinese company. Tenda M3 is vulnerable to command injection, which stems from the failure of the component /goform/delAd to properly filter the construction of command special characters, commands, etc. An attacker could use this vulnerability to cause...

PT-2022-18210 · Tenda · Tenda M3

Name of the Vulnerable Software and Affected Versions: Tenda M3 version 1.10 V1.0.0.124856 Description: A command injection issue was found in the component "/goform/SetLanInfo" of the affected software. Recommendations: For version 1.10 V1.0.0.124856, consider restricting access to the...

CVE-2022-26290: Improper Neutralization of Special Elements used in an OS Command

Tenda M3 1.10 V1.0.0.124856 was discovered to contain a command injection vulnerability via the component /goform/WriteFacMac...

CVE-2022-27076: Improper Neutralization of Special Elements used in a Command

Tenda M3 1.10 V1.0.0.124856 was discovered to contain a command injection vulnerability via the component /goform/delAd...

CVE-2021-46393

There is a stack buffer overflow vulnerability in the formSetPPTPServer function of Tenda-AX3 router V16.03.12.10CN. The v10 variable is directly retrieved from the http request parameter startIp. Then v10 will be splice to stack by function sscanf without any security check,which causes stack...

CVE-2021-45391: Out-of-bounds Write

A Buffer Overflow vulnerability exists in Tenda Router AX12 V22.03.01.21CN in the sub422CE4 function in the goform/setIPv6Status binary file /usr/sbin/httpd via the conType parameter, which causes a Denial of Service...

CVE-2021-44154

An issue was discovered in Reprise RLM 14.2. By using an admin account, an attacker can write a payload to /goform/editopt, which will then be triggered when running the diagnostics via /goform/diagnosticsdoit, resulting in a buffer overflow...

CVE-2021-44154: Buffer Copy without Checking Size of Input

An issue was discovered in Reprise RLM 14.2. By using an admin account, an attacker can write a payload to /goform/editopt, which will then be triggered when running the diagnostics via /goform/diagnosticsdoit, resulting in a buffer overflow...

PT-2021-24049 · Reprise · Reprise Rlm

Name of the Vulnerable Software and Affected Versions: Reprise RLM version 14.2 Description: An issue was discovered where the "/goform/change password process" API endpoint does not verify authentication or authorization, allowing an unauthenticated user to change the password of any existing...

The vulnerability of the formsetUsbUnload function in the microprogramming software for Tenda AC7, Tenda AC9, and Tenda AC10 allows a hacker to execute arbitrary operating system commands.

The vulnerability of the formsetUsbUnload function in the microprogramming software for Tenda AC7, Tenda AC9, and Tenda AC10 exists due to the lack of measures taken to neutralize the special elements used in the operating system command. Exploiting this vulnerability allows a malicious actor to...

PT-2021-24085 · Tenda · Tenda Ac15

Name of the Vulnerable Software and Affected Versions: Tenda AC15 version V15.03.05.18 multi Description: A Stack-based Buffer Overflow issue exists in the Tenda AC15 device via the list parameter in a POST request in "goform/SetIpMacBind". Recommendations: For Tenda AC15 version V15.03.05.18...

Tenda AC15 缓冲区错误漏洞

The Tenda AC15 is a wireless router from the Chinese company Tenda. A security vulnerability exists in Tenda AC15 version 15.03.05.18multi, which can be exploited by an attacker through a buffer overflow vulnerability in the post request in "goform/SetIpMacBind"...

CVE-2021-44352: Out-of-bounds Write

A Stack-based Buffer Overflow vulnerability exists in the Tenda AC15 V15.03.05.18multi device via the list parameter in a post request in goform/SetIpMacBind...

Tenda AC7, AC9, and AC10 Routers Command Injection Vulnerability

Tenda AC7, AC9, and AC10 devices contain a command injection vulnerability due to the "formsetUsbUnload" function executes a dosystemCmd function with untrusted input. Successful exploitation allows an attacker to execute OS commands via a crafted goform/setUsbUnload request...

Tenda AC-10U 缓冲区错误漏洞

The Tenda AC-10U is a wireless router from Tenda, a Chinese company. A buffer overflow vulnerability exists in the Tenda AC-10U AC1200 router due to a boundary error when handling untrusted input. A remote attacker could execute arbitrary code via the timeZone parameter of goform/SetSysTimeCfg...

CVE-2020-22079: Out-of-bounds Write

Stack-based buffer overflow in Tenda AC-10U AC1200 Router USAC10UV1.0RTLV15.03.06.48multiTDE01 allows remote attackers to execute arbitrary code via the timeZone parameter to goform/SetSysTimeCfg...