Tenda AC15 AC1900 version 15.03.05.19 - Command Injection

The goform/setUsbUnload endpoint of Tenda AC15 AC1900 version 15.03.05.19 allows remote attackers to execute arbitrary system commands via the deviceName POST parameter. id: CVE-2020-10987 info: name: Tenda AC15 AC1900 version 15.03.05.19 - Command Injection author: pussycat0x severity: critical...

Tenda-Router-VR-and-Exploit

Tenda-Router-VR-and-Exploit This write-up shows exactly how I emulated the AC15 V15.03.05.19 firmware’s webserver with QEMU, made it reachable from the host browser, and exercised the vulnerable /goform/setUsbUnload handler CVE-2020-10987 to get command execution inside the emulated rootfs...

CVE-2020-10987

The goform/setUsbUnload endpoint of Tenda AC15 AC1900 version 15.03.05.19 allows remote attackers to execute arbitrary system commands via the deviceName POST parameter...

Exploit for OS Command Injection in Tenda Ac15_Firmware

Tenda-Router-VR-and-Exploit...

Tenda Routers Command Injection (CVE-2020-10987; CVE-2018-14558)

A command injection vulnerability exists in Tenda Routers. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary commands on the affected system...

CVE-2020-10987

creationtimestamp| type| source ---|---|--- 2020-10-05 09:50:10+00:00| exploited| https://t.me/informationsecuritychannel/40792 2020-10-09 13:20:55+00:00| seen| MISP/2ec4ee12-9ad3-4dba-afe0-4644cf9f52b5 2020-10-09 13:24:39+00:00| seen| MISP/b14f5ca4-fb33-4da3-ad29-dcaf9e3d3fc4 2020-10-09...

CVE-2020-10987

The goform/setUsbUnload endpoint of Tenda AC15 AC1900 version 15.03.05.19 allows remote attackers to execute arbitrary system commands via the deviceName POST parameter...

CVE-2020-10987

CVE-2020-10987 affects the Tenda AC15/AC1900 router family (firmware 15.03.05.19 and earlier). The vulnerability resides in the goform/setUsbUnload endpoint, where an unauthenticated attacker can send a crafted deviceName POST parameter to remotely execute arbitrary system commands. Public source...

CVE-2020-10987

The goform/setUsbUnload endpoint of Tenda AC15 AC1900 version 15.03.05.19 allows remote attackers to execute arbitrary system commands via the deviceName POST parameter...

CVE-2020-10987

The goform/setUsbUnload endpoint of Tenda AC15 AC1900 version 15.03.05.19 allows remote attackers to execute arbitrary system commands via the deviceName POST parameter. Recent assessments: Assessed Attacker Value: 0 Assessed Attacker Value: 0Assessed Attacker Value: 0...