CVE-2020-10988

A hard-coded telnet credential in the tendalogin binary of Tenda AC15 AC1900 version 15.03.05.19 allows unauthenticated remote attackers to start a telnetd service on the device...

CVE-2020-10989

An XSS issue in the /goform/WifiBasicSet endpoint of Tenda AC15 AC1900 version 15.03.05.19 allows remote attackers to execute malicious payloads via the WifiName POST parameter...

Cross site scripting

An XSS issue in the /goform/WifiBasicSet endpoint of Tenda AC15 AC1900 version 15.03.05.19 allows remote attackers to execute malicious payloads via the WifiName POST parameter...

Hardcoded credentials

A hard-coded telnet credential in the tendalogin binary of Tenda AC15 AC1900 version 15.03.05.19 allows unauthenticated remote attackers to start a telnetd service on the device...

Design/Logic Flaw

The goform/setUsbUnload endpoint of Tenda AC15 AC1900 version 15.03.05.19 allows remote attackers to execute arbitrary system commands via the deviceName POST parameter...

CVE-2020-10987

The goform/setUsbUnload endpoint of Tenda AC15 AC1900 version 15.03.05.19 allows remote attackers to execute arbitrary system commands via the deviceName POST parameter...

CVE-2020-10987

The goform/setUsbUnload endpoint of Tenda AC15 AC1900 version 15.03.05.19 allows remote attackers to execute arbitrary system commands via the deviceName POST parameter...

CVE-2020-10987

CVE-2020-10987 affects the Tenda AC15/AC1900 router family (firmware 15.03.05.19 and earlier). The vulnerability resides in the goform/setUsbUnload endpoint, where an unauthenticated attacker can send a crafted deviceName POST parameter to remotely execute arbitrary system commands. Public source...

CVE-2020-10986

A CSRF issue in the /goform/SysToolReboot endpoint of Tenda AC15 AC1900 version 15.03.05.19 allows remote attackers to reboot the device and cause denial of service via a payload hosted by an attacker-controlled web page...

Cross site request forgery (csrf)

A CSRF issue in the /goform/SysToolReboot endpoint of Tenda AC15 AC1900 version 15.03.05.19 allows remote attackers to reboot the device and cause denial of service via a payload hosted by an attacker-controlled web page...

CVE-2020-10989

CVE-2020-10989 refers to a Cross-Site Scripting vulnerability in the Tenda AC15 AC1900 router (firmware version 15.03.05.19). The XSS is triggered via the /goform/WifiBasicSet endpoint through the WifiName POST parameter. Affected component appears to be the web UI handling WifiName input; root c...

CVE-2020-10989

An XSS issue in the /goform/WifiBasicSet endpoint of Tenda AC15 AC1900 version 15.03.05.19 allows remote attackers to execute malicious payloads via the WifiName POST parameter...

CVE-2020-10988

A hard-coded telnet credential in the tendalogin binary of Tenda AC15 AC1900 version 15.03.05.19 allows unauthenticated remote attackers to start a telnetd service on the device...

CVE-2020-10988

The CVE-2020-10988 issue concerns the Tenda AC15 AC1900 router (firmware version 15.03.05.19). A hard-coded telnet credential in the tenda_login binary allows unauthenticated remote attackers to start a telnetd service on the device, enabling remote access at the network layer. This is the underl...

CVE-2020-10986

CVE-2020-10986 refers to a CSRF vulnerability in the Tenda AC15 AC1900 router (version 15.03.05.19) where exploitation of the /goform/SysToolReboot endpoint allows remote attackers to cause a reboot and denial of service by hosting a payload on a malicious page. The root cause is cross-site reque...

CVE-2020-10986

A CSRF issue in the /goform/SysToolReboot endpoint of Tenda AC15 AC1900 version 15.03.05.19 allows remote attackers to reboot the device and cause denial of service via a payload hosted by an attacker-controlled web page...

PT-2020-4297

Name of the Vulnerable Software and Affected Versions Tenda AC15 AC1900 version 15.03.05.19 Description Remote attackers can execute arbitrary system commands due to insufficient neutralization of special elements passed in the URI. This issue occurs at the 'goform/setUsbUnload' endpoint via the...

CVE-2020-10987

The goform/setUsbUnload endpoint of Tenda AC15 AC1900 version 15.03.05.19 allows remote attackers to execute arbitrary system commands via the deviceName POST parameter. Recent assessments: Assessed Attacker Value: 0 Assessed Attacker Value: 0Assessed Attacker Value: 0...

CVE-2018-18732

An issue was discovered on Tenda AC7 V15.03.06.44CN, AC9 V15.03.05.196318CN, AC10 V15.03.06.23CN, AC15 V15.03.05.19CN, and AC18 V15.03.05.196318CN devices. There is a buffer overflow vulnerability in the router's web server -- httpd. While processing the 'ntpServer' parameter for a post request,...

CVE-2018-18728

An issue was discovered on Tenda AC9 V15.03.05.196318CN, AC15 V15.03.05.19CN, and AC18 V15.03.05.196318CN devices. They allow remote code execution via shell metacharacters in the usbName field to the fastcall function with a POST request...