Tenda-Router-VR-and-Exploit

Tenda-Router-VR-and-Exploit This write-up shows exactly how I emulated the AC15 V15.03.05.19 firmware’s webserver with QEMU, made it reachable from the host browser, and exercised the vulnerable /goform/setUsbUnload handler CVE-2020-10987 to get command execution inside the emulated rootfs...

EUVD-2023-34564

Malicious code in bioql PyPI...

CVE-2023-30135

Tenda AC18 v15.03.05.196318cn was discovered to contain a command injection vulnerability via the deviceName parameter in the setUsbUnload function...

CVE-2021-45401

A Command injection vulnerability exists in Tenda AC10U AC1200 Smart Dual-band Wireless Router AC10U V1.0 Firmware V15.03.06.49multi via the setUsbUnload functionality. The vulnerability is caused because the client controlled "deviceName" value is passed directly to the "doSystemCmd" function...

Tenda AC18 Set UsbUnload DoS

The vulnerability of the setUsbUnload function in the microprogramming software for Tenda AC18 routers is related to insufficient cleaning of input data during the processing of the deviceName parameter. Exploiting this vulnerability can allow a malicious actor to cause service failure remotely...

Tenda AC18 setUsbUnload Function Command Injection Vulnerability

Tenda AC18 is a dual-band wireless router launched by Shenzhen Jixiang Tenda Technology Co. in July 2016, mainly for villas and large home users. Tenda AC18 suffers from a command injection vulnerability, which stems from the existence of a command injection vulnerability via the deviceName...

CVE-2023-30135

Tenda AC18 v15.03.05.196318cn was discovered to contain a command injection vulnerability via the deviceName parameter in the setUsbUnload function...

CVE-2023-30135

Tenda AC18 v15.03.05.196318cn was discovered to contain a command injection vulnerability via the deviceName parameter in the setUsbUnload function...

Command injection

Tenda AC18 v15.03.05.196318cn was discovered to contain a command injection vulnerability via the deviceName parameter in the setUsbUnload function...

CVE-2023-30135: Improper Neutralization of Special Elements used in a Command

Tenda AC18 v15.03.05.196318cn was discovered to contain a command injection vulnerability via the deviceName parameter in the setUsbUnload function...

CVE-2023-30135

Tenda AC18 v15.03.05.196318cn was discovered to contain a command injection vulnerability via the deviceName parameter in the setUsbUnload function...

CVE-2023-30135

Tenda AC18 v15.03.05.196318cn was discovered to contain a command injection vulnerability via the deviceName parameter in the setUsbUnload function...

PT-2023-3073 · Tenda · Tenda Ac18

Name of the Vulnerable Software and Affected Versions: Tenda AC18 version 15.03.05.196318 cn Description: The issue is related to a command injection vulnerability via the deviceName parameter in the setUsbUnload function. This vulnerability can be exploited by a remote attacker to cause a denial...

Tenda AC18 command injection vulnerability

Tenda AC18 is a dual-band wireless router launched by Shenzhen Jixiang Tenda Technology Co. in July 2016, mainly for villas and large home users. Tenda AC18 suffers from a command injection vulnerability, which stems from the existence of a command injection vulnerability via the deviceName...

CVE-2021-45401

A Command injection vulnerability exists in Tenda AC10U AC1200 Smart Dual-band Wireless Router AC10U V1.0 Firmware V15.03.06.49multi via the setUsbUnload functionality. The vulnerability is caused because the client controlled "deviceName" value is passed directly to the "doSystemCmd" function...

CVE-2021-45401

A Command injection vulnerability exists in Tenda AC10U AC1200 Smart Dual-band Wireless Router AC10U V1.0 Firmware V15.03.06.49multi via the setUsbUnload functionality. The vulnerability is caused because the client controlled "deviceName" value is passed directly to the "doSystemCmd" function...

Command injection

A Command injection vulnerability exists in Tenda AC10U AC1200 Smart Dual-band Wireless Router AC10U V1.0 Firmware V15.03.06.49multi via the setUsbUnload functionality. The vulnerability is caused because the client controlled "deviceName" value is passed directly to the "doSystemCmd" function...

CVE-2021-45401: Improper Neutralization of Special Elements used in a Command

A Command injection vulnerability exists in Tenda AC10U AC1200 Smart Dual-band Wireless Router AC10U V1.0 Firmware V15.03.06.49multi via the setUsbUnload functionality. The vulnerability is caused because the client controlled "deviceName" value is passed directly to the "doSystemCmd" function...

PT-2022-12342

Name of the Vulnerable Software and Affected Versions Tenda AC10U AC1200 Smart Dual-band Wireless Router AC10U V1.0 Firmware V15.03.06.49 multi Description A Command injection issue exists via the setUsbUnload functionality. The issue is caused because the client-controlled deviceName value is...

Tenda AC7/AC9/AC10 Formset UsbUnload Command Execution

The vulnerability of the formsetUsbUnload function in the microprogramming software for Tenda AC7, Tenda AC9, and Tenda AC10 exists due to the lack of measures taken to neutralize the special elements used in the operating system command. Exploiting this vulnerability allows a malicious actor to...