PT-2023-9016 · Tenda · Tenda Ac23

Dengxiquan · Publicado 2023-05-11 · Atualizado 2024-05-17 · CVE-2023-2649

Positive Technologies (AI Summary)

CVSS v2.0

9.0

Alta

Vetor base

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Tenda AC23 version 16.03.07.45 cn

Description The issue is related to insufficient argument checking in the Service Port 7329 component of the Tenda AC23 router's firmware, which can lead to command injection. This can be exploited by a remote attacker to execute arbitrary commands. The manipulation of the v2 argument is the key to this vulnerability. The attack can be initiated remotely.

Recommendations For Tenda AC23 version 16.03.07.45 cn, as a temporary workaround, consider restricting access to the Service Port 7329 component until a patch is available. Avoid using the v2 argument in the affected command until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Command Injection

Enumeração de Fraquezas

CWE-77

Identificadores relacionados

BDU:2024-03021

CVE-2023-2649

Produtos afetados

Tenda Ac23

Referências · 8

• 🔥 https://github.com/xinzhihen06/ac23tenda/blob/main/tendaAC23.md · Exploit
• https://osv.dev/vulnerability/CVE-2023-2649 · Aviso do Fabricante
• https://vuldb.com/?ctiid.228778 · Nota
• https://t.me/cibsecurity/63865 · Publicação no Telegram
• https://bdu.fstec.ru/vul/2024-03021 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2023-2649 · Nota de Segurança
• https://t.me/cvenotify/50828 · Publicação no Telegram
• https://vuldb.com/?id.228778 · Nota