CVE-2025-25675

Tenda AC10 V1.0 V15.03.06.23 has a command injection vulnerablility located in the formexeCommand function. The str variable receives the cmdinput parameter from a POST request and is later assigned to the cmdbuf variable, which is directly used in the doSystemCmd function, causing an arbitrary...

PT-2025-7567 · Tenda · Tenda Ac10

Name of the Vulnerable Software and Affected Versions: Tenda AC10 V1.0 V15.03.06.23 Description: The issue is related to a command injection vulnerability located in the formexeCommand function. The str variable receives the cmdinput parameter from a POST request and is later assigned to the cmd...

CVE-2025-25675

Tenda AC10 V1.0 V15.03.06.23 has a command injection vulnerablility located in the formexeCommand function. The str variable receives the cmdinput parameter from a POST request and is later assigned to the cmdbuf variable, which is directly used in the doSystemCmd function, causing an arbitrary...

CVE-2025-25675

Summary: CVE-2025-25675 affects Tenda AC10 (V1.0, V15.03.06.23). The vulnerability is a command injection in the formexeCommand function. The code flow: the POST parameter cmdinput is assigned to str, then to cmd_buf, which is directly used by doSystemCmd, enabling arbitrary command execution. Mu...

PT-2022-19714

Name of the Vulnerable Software and Affected Versions Tenda TX9 Pro version 22.03.02.10 Description The issue allows OS command injection via the set route function, which is called by doSystemCmd route. This enables potential attackers to inject commands into the operating system, posing a...

Tenda AC9 Command Injection Vulnerability (CNVD-2022-26241)

Tenda AC9 is a wireless router from Tenda, China.A command injection vulnerability exists in Tenda AC9 version 15.03.2.21, which stems from the failure of the dosystemcmd parameter in the suba3550 function to properly filter the special elements of the construction snippet, which can be exploited...

Tenda AC9: Operating System Command Injection Vulnerability

Tenda AC9 is a wireless router from Tenda, China.A command injection vulnerability exists in Tenda AC9 version 15.03.2.21, which stems from the failure of the dosystemcmd parameter in the suba3550 function to properly filter the special elements of the construction snippet, which can be exploited...

CVE-2021-45401

A Command injection vulnerability exists in Tenda AC10U AC1200 Smart Dual-band Wireless Router AC10U V1.0 Firmware V15.03.06.49multi via the setUsbUnload functionality. The vulnerability is caused because the client controlled "deviceName" value is passed directly to the "doSystemCmd" function...

CVE-2021-45401

A Command injection vulnerability exists in Tenda AC10U AC1200 Smart Dual-band Wireless Router AC10U V1.0 Firmware V15.03.06.49multi via the setUsbUnload functionality. The vulnerability is caused because the client controlled "deviceName" value is passed directly to the "doSystemCmd" function...

Command injection

A Command injection vulnerability exists in Tenda AC10U AC1200 Smart Dual-band Wireless Router AC10U V1.0 Firmware V15.03.06.49multi via the setUsbUnload functionality. The vulnerability is caused because the client controlled "deviceName" value is passed directly to the "doSystemCmd" function...

Tenda AC10 security vulnerabilities

The Tenda AC10U is a router designed with Gigabit ports on both WAN and LAN ports.A command injection vulnerability exists in the Tenda AC10U, which stems from the deviceName value of the client control being passed directly to the doSystemCmd function. An attacker could use this vulnerability to...

CVE-2021-45401: Improper Neutralization of Special Elements used in a Command

A Command injection vulnerability exists in Tenda AC10U AC1200 Smart Dual-band Wireless Router AC10U V1.0 Firmware V15.03.06.49multi via the setUsbUnload functionality. The vulnerability is caused because the client controlled "deviceName" value is passed directly to the "doSystemCmd" function...

PT-2022-12342

Name of the Vulnerable Software and Affected Versions Tenda AC10U AC1200 Smart Dual-band Wireless Router AC10U V1.0 Firmware V15.03.06.49 multi Description A Command injection issue exists via the setUsbUnload functionality. The issue is caused because the client-controlled deviceName value is...

CVE-2021-27692

Command Injection in Tenda G1 and G3 routers with firmware versions v15.11.0.179502CN or v15.11.0.169024CN allows remote attackers to execute arbitrary OS commands via a crafted "action/umountUSBPartition" request. This occurs because the "formSetUSBPartitionUmount" function executes the...

Command injection

Command Injection in Tenda G1 and G3 routers with firmware versions v15.11.0.179502CN or v15.11.0.169024CN allows remote attackers to execute arbitrary OS commands via a crafted "action/umountUSBPartition" request. This occurs because the "formSetUSBPartitionUmount" function executes the...

CVE-2021-27692: Improper Neutralization of Special Elements used in an OS Command

Command Injection in Tenda G1 and G3 routers with firmware versions v15.11.0.179502CN or v15.11.0.169024CN allows remote attackers to execute arbitrary OS commands via a crafted "action/umountUSBPartition" request. This occurs because the "formSetUSBPartitionUmount" function executes the...

CVE-2018-14558

An issue was discovered on Tenda AC7 devices with firmware through V15.03.06.44CNAC7, AC9 devices with firmware through V15.03.05.196318CNAC9, and AC10 devices with firmware through V15.03.06.23CNAC10. A command Injection vulnerability allows attackers to execute arbitrary OS commands via a craft...

CVE-2018-14558: Improper Neutralization of Special Elements used in an OS Command

An issue was discovered on Tenda AC7 devices with firmware through V15.03.06.44CNAC7, AC9 devices with firmware through V15.03.05.196318CNAC9, and AC10 devices with firmware through V15.03.06.23CNAC10. A command Injection vulnerability allows attackers to execute arbitrary OS commands via a craft...

Tenda AC9 and AC10 Operating System Command Injection Vulnerability

Tenda AC9 is a wireless router product from Tenda, a Chinese company. An operating system command injection vulnerability exists in Tenda AC9 version 15.03.05.196318CN and AC10 version 15.03.06.23CN and earlier versions, which originates from the 'mcc' parameter in a POST request being used...

CVE-2018-16334: Improper Neutralization of Special Elements used in an OS Command

An issue was discovered on Tenda AC9 V15.03.05.196318CN and AC10 V15.03.06.23CN devices. The mac parameter in a POST request is used directly in a doSystemCmd call, causing OS command injection...