PT-2025-1260 · Tenda · Tenda Ac18+2
Pr0B1Em
·
Publicado
2025-01-09
·
Atualizado
2025-05-28
·
CVE-2025-0528
CVSS v4.0
8.6
Alta
| Vetor | AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
Tenda AC8 versions 16.03.10.20
Tenda AC10 versions 16.03.10.20
Tenda AC18 versions 16.03.10.20
Description
A critical issue has been found in the HTTP Request Handler component of the affected devices, specifically in the
/goform/telnet file. This issue leads to command injection and can be exploited remotely. The problem is related to the lack of data sanitization on the management level of the telnetd daemon, allowing an attacker to execute arbitrary commands. The exploit for this issue has been publicly disclosed.Recommendations
For Tenda AC8 version 16.03.10.20, consider disabling the
/goform/telnet endpoint until a patch is available.
For Tenda AC10 version 16.03.10.20, restrict access to the HTTP Request Handler component to minimize the risk of exploitation.
For Tenda AC18 version 16.03.10.20, avoid using the telnetd daemon until the issue is resolved.
As a temporary workaround, consider disabling the telnetd daemon on all affected devices until a patch is available.Exploit
Correção
Command Injection
Special Elements Injection
OS Command Injection
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Tenda Ac10
Tenda Ac18
Tenda Ac8