Tenda M3 Command Injection Vulnerability (CNVD-2022-33117)

Tenda M3 is an access control from Tenda, a Chinese company. Tenda M3 is vulnerable to command injection, which stems from the component /goform/setPicListItem fails to properly filter the construct command special characters, commands, etc., and can be exploited by attackers to cause arbitrary...