CVE-2021-38278

Tenda AC10-1200 v15.03.06.23EN was discovered to contain a buffer overflow via the urls parameter in the saveParentControlInfo function...

Tenda AC10 缓冲区错误漏洞

Tenda AC10-1200 is a wireless router from Tenda China.A buffer error vulnerability exists in the Tenda AC10-1200, which stems from a failure to properly validate data boundaries when performing operations on memory in the setSmartPowerManagement function. An attacker could exploit this...

The vulnerability of the formsetUsbUnload function in the microprogramming software for Tenda AC7, Tenda AC9, and Tenda AC10 allows a hacker to execute arbitrary operating system commands.

The vulnerability of the formsetUsbUnload function in the microprogramming software for Tenda AC7, Tenda AC9, and Tenda AC10 exists due to the lack of measures taken to neutralize the special elements used in the operating system command. Exploiting this vulnerability allows a malicious actor to...

Tenda AC7, AC9, and AC10 Routers Command Injection Vulnerability

Tenda AC7, AC9, and AC10 devices contain a command injection vulnerability due to the "formsetUsbUnload" function executes a dosystemCmd function with untrusted input. Successful exploitation allows an attacker to execute OS commands via a crafted goform/setUsbUnload request...

VulnCheck KEV: CVE-2018-14558

Tenda AC7, AC9, and AC10 devices contain a command injection vulnerability due to the "formsetUsbUnload" function executes a dosystemCmd function with untrusted input. Successful exploitation allows an attacker to execute OS commands via a crafted goform/setUsbUnload request...

CVE-2018-14557

An issue was discovered on Tenda AC7 devices with firmware through V15.03.06.44CNAC7, AC9 devices with firmware through V15.03.05.196318CNAC9, and AC10 devices with firmware through V15.03.06.23CNAC10. A buffer overflow vulnerability exists in the router's web server httpd. When processing the pa...

CVE-2018-14559

An issue was discovered on Tenda AC7 devices with firmware through V15.03.06.44CNAC7, AC9 devices with firmware through V15.03.05.196318CNAC9, and AC10 devices with firmware through V15.03.06.23CNAC10. A buffer overflow vulnerability exists in the router's web server httpd. When processing the li...

Buffer overflow

An issue was discovered on Tenda AC7 devices with firmware through V15.03.06.44CNAC7, AC9 devices with firmware through V15.03.05.196318CNAC9, and AC10 devices with firmware through V15.03.06.23CNAC10. A buffer overflow vulnerability exists in the router's web server httpd. When processing the pa...

CVE-2018-14559

CVE-2018-14559 describes a buffer overflow in Tenda devices (AC7 firmware V15.03.06.44_CN, AC9 V15.03.05.19(6318)_CN, AC10 V15.03.06.23_CN) caused by writing POST list parameters with sprintf to a stack variable in the httpd web server, which can overwrite a return address. Primary impact is high...

Tenda AC7, AC9 and AC10 Command Injection Vulnerabilities

The Tenda AC7, AC9 and AC10 are all wireless router products from Tenda, a Chinese company. A command injection vulnerability exists in the Tenda AC7, AC9, and AC10. An attacker can exploit this vulnerability by sending a specially crafted request to execute arbitrary operating system commands...

CVE-2018-14558

An issue was discovered on Tenda AC7 devices with firmware through V15.03.06.44CNAC7, AC9 devices with firmware through V15.03.05.196318CNAC9, and AC10 devices with firmware through V15.03.06.23CNAC10. A command Injection vulnerability allows attackers to execute arbitrary OS commands via a craft...

Command injection

An issue was discovered on Tenda AC7 devices with firmware through V15.03.06.44CNAC7, AC9 devices with firmware through V15.03.05.196318CNAC9, and AC10 devices with firmware through V15.03.06.23CNAC10. A command Injection vulnerability allows attackers to execute arbitrary OS commands via a craft...

CVE-2018-14558

CVE-2018-14558 affects Tenda AC7/AC9/AC10 routers (firmware: AC7 ≤ V15.03.06.44_CN, AC9 ≤ V15.03.05.19(6318)_CN, AC10 ≤ V15.03.06.23_CN). The flaw arises in the formsetUsbUnload function, which calls dosystemCmd with untrusted input via a crafted goform/setUsbUnload request, leading to arbitrary ...

CVE-2018-18732

An issue was discovered on Tenda AC7 V15.03.06.44CN, AC9 V15.03.05.196318CN, AC10 V15.03.06.23CN, AC15 V15.03.05.19CN, and AC18 V15.03.05.196318CN devices. There is a buffer overflow vulnerability in the router's web server -- httpd. While processing the 'ntpServer' parameter for a post request,...

Buffer overflow

An issue was discovered on Tenda AC7 V15.03.06.44CN, AC9 V15.03.05.196318CN, AC10 V15.03.06.23CN, AC15 V15.03.05.19CN, and AC18 V15.03.05.196318CN devices. It is a buffer overflow vulnerability in the router's web server -- httpd. When processing the "page" parameter of the function...

Buffer overflow

An issue was discovered on Tenda AC7 V15.03.06.44CN, AC9 V15.03.05.196318CN, AC10 V15.03.06.23CN, AC15 V15.03.05.19CN, and AC18 V15.03.05.196318CN devices. There is a buffer overflow vulnerability in the router's web server -- httpd. While processing the 'startIp' and 'endIp' parameters for a pos...

CVE-2018-18729

Affected devices are Tenda routers AC7 (V15.03.06.44_CN), AC9 (V15.03.05.19(6318)_CN), AC10 (V15.03.06.23_CN), AC15 (V15.03.05.19_CN), and AC18 (V15.03.05.19(6318)_CN). The issue is a heap-based buffer overflow in the router web server (httpd). During processing of the mac parameter for a POST re...

CVE-2018-18706

CVE-2018-18706 affects Tenda AC7/AC9/AC10/AC15/AC18 routers. The vulnerability exists in the router’s web server (httpd) where, on processing the page parameter of the function fromDhcpListClient , the value is directly used in a sprintf into a stack-based local variable, overriding the function’...

Tenda AC9 and AC10 Operating System Command Injection Vulnerability

Tenda AC9 is a wireless router product from Tenda, a Chinese company. An operating system command injection vulnerability exists in Tenda AC9 version 15.03.05.196318CN and AC10 version 15.03.06.23CN and earlier versions, which originates from the 'mcc' parameter in a POST request being used...

CVE-2018-16334

An issue was discovered on Tenda AC9 V15.03.05.196318CN and AC10 V15.03.06.23CN devices. The mac parameter in a POST request is used directly in a doSystemCmd call, causing OS command injection...