CVE-2026-24105

An issue was discovered in goform/formsetUsbUnload in Tenda AC15V1.0 V15.03.05.18multi. The value of v1 was not checked, potentially leading to a command injection vulnerability if injected into doSystemCmd...

CVE-2026-24105

The Tenda AC15V1.0 wireless router (versions prior to V15.03.05.18 multi ) contains a command injection vulnerability in the goform/formsetUsbUnload component. The root cause is a lack of validation for the v1 parameter, which can be exploited if injected into the doSystemCmd function. Successful...

CVE-2025-44872

Tenda AC9 V15.03.06.42multi was found to contain a command injection vulnerability in the formsetUsbUnload function via the deviceName parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...