EUVD-2026-9196

An issue was discovered in goform/formSetIptv in Tenda AC15V1.0 V15.03.05.18multi. When the condition is met, s11 will be passed into subB0488, concatenated into doSystemCmd. The value of s11 is not validated, potentially leading to a command injection vulnerability...

CVE-2026-24101

Summary: CVE-2026-24101 affects Tenda AC15 router goform/formSetIptv. The vulnerability arises when processing the s1_1 parameter, which is passed into sub_B0488 and concatenated into doSystemCmd without validation, enabling potential command injection. Affected device: Tenda AC15V1.0 V15.03.05.1...