Tenda AC15 AC1900 Remote Code Execution Vulnerability

Tenda AC15 AC1900 is a wireless router from Tenda, a Chinese company. A remote code execution vulnerability exists in the goform/setUsbUnload endpoint in the Tenda AC15 AC1900 version 15.03.05.19, which can be exploited to execute arbitrary system commands via the deviceName POST parameter...

CVE-2020-10988

A hard-coded telnet credential in the tendalogin binary of Tenda AC15 AC1900 version 15.03.05.19 allows unauthenticated remote attackers to start a telnetd service on the device...

CVE-2020-10989

An XSS issue in the /goform/WifiBasicSet endpoint of Tenda AC15 AC1900 version 15.03.05.19 allows remote attackers to execute malicious payloads via the WifiName POST parameter...

CVE-2020-10988

A hard-coded telnet credential in the tendalogin binary of Tenda AC15 AC1900 version 15.03.05.19 allows unauthenticated remote attackers to start a telnetd service on the device...

CVE-2020-10987

The goform/setUsbUnload endpoint of Tenda AC15 AC1900 version 15.03.05.19 allows remote attackers to execute arbitrary system commands via the deviceName POST parameter...

CVE-2020-10987

The goform/setUsbUnload endpoint of Tenda AC15 AC1900 version 15.03.05.19 allows remote attackers to execute arbitrary system commands via the deviceName POST parameter...

Design/Logic Flaw

The goform/setUsbUnload endpoint of Tenda AC15 AC1900 version 15.03.05.19 allows remote attackers to execute arbitrary system commands via the deviceName POST parameter...

Cross site scripting

An XSS issue in the /goform/WifiBasicSet endpoint of Tenda AC15 AC1900 version 15.03.05.19 allows remote attackers to execute malicious payloads via the WifiName POST parameter...

Hardcoded credentials

A hard-coded telnet credential in the tendalogin binary of Tenda AC15 AC1900 version 15.03.05.19 allows unauthenticated remote attackers to start a telnetd service on the device...

CVE-2020-10987

The goform/setUsbUnload endpoint of Tenda AC15 AC1900 version 15.03.05.19 allows remote attackers to execute arbitrary system commands via the deviceName POST parameter...

CVE-2020-10987

The goform/setUsbUnload endpoint of Tenda AC15 AC1900 version 15.03.05.19 allows remote attackers to execute arbitrary system commands via the deviceName POST parameter...

CVE-2020-10987

CVE-2020-10987 affects the Tenda AC15/AC1900 router family (firmware 15.03.05.19 and earlier). The vulnerability resides in the goform/setUsbUnload endpoint, where an unauthenticated attacker can send a crafted deviceName POST parameter to remotely execute arbitrary system commands. Public source...

CVE-2020-10986

A CSRF issue in the /goform/SysToolReboot endpoint of Tenda AC15 AC1900 version 15.03.05.19 allows remote attackers to reboot the device and cause denial of service via a payload hosted by an attacker-controlled web page...

Cross site request forgery (csrf)

A CSRF issue in the /goform/SysToolReboot endpoint of Tenda AC15 AC1900 version 15.03.05.19 allows remote attackers to reboot the device and cause denial of service via a payload hosted by an attacker-controlled web page...

CVE-2020-10989

An XSS issue in the /goform/WifiBasicSet endpoint of Tenda AC15 AC1900 version 15.03.05.19 allows remote attackers to execute malicious payloads via the WifiName POST parameter...

CVE-2020-10989

CVE-2020-10989 refers to a Cross-Site Scripting vulnerability in the Tenda AC15 AC1900 router (firmware version 15.03.05.19). The XSS is triggered via the /goform/WifiBasicSet endpoint through the WifiName POST parameter. Affected component appears to be the web UI handling WifiName input; root c...

CVE-2020-10988

The CVE-2020-10988 issue concerns the Tenda AC15 AC1900 router (firmware version 15.03.05.19). A hard-coded telnet credential in the tenda_login binary allows unauthenticated remote attackers to start a telnetd service on the device, enabling remote access at the network layer. This is the underl...

CVE-2020-10988

A hard-coded telnet credential in the tendalogin binary of Tenda AC15 AC1900 version 15.03.05.19 allows unauthenticated remote attackers to start a telnetd service on the device...

CVE-2020-10986

A CSRF issue in the /goform/SysToolReboot endpoint of Tenda AC15 AC1900 version 15.03.05.19 allows remote attackers to reboot the device and cause denial of service via a payload hosted by an attacker-controlled web page...

CVE-2020-10986

CVE-2020-10986 refers to a CSRF vulnerability in the Tenda AC15 AC1900 router (version 15.03.05.19) where exploitation of the /goform/SysToolReboot endpoint allows remote attackers to cause a reboot and denial of service by hosting a payload on a malicious page. The root cause is cross-site reque...