PT-2020-12471 · Tenda · Tenda Ac15 Ac1900

Published 2020-07-13 · Updated 2020-07-15 · CVE-2020-10986

Positive Technologies (AI Summary)

CVSS v2.0

7.1

High

Base vector

AV:N/AC:M/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Tenda AC15 AC1900 version 15.03.05.19

Description A CSRF issue allows remote attackers to reboot the device and cause denial of service via a payload hosted by an attacker-controlled web page, specifically targeting the "goform/SysToolReboot" endpoint.

Recommendations For Tenda AC15 AC1900 version 15.03.05.19, consider disabling access to the /goform/SysToolReboot endpoint until a patch is available. Restrict access to this endpoint to minimize the risk of exploitation. Avoid using this endpoint in production environments until the issue is resolved.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2020-10986

Affected Products

Tenda Ac15 Ac1900

References · 5

• 🔥 https://blog.securityevaluators.com/tenda-ac1900-vulnerabilities-discovered-and-exploited-e8e26aa0bc68 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-10986 · Security Note
• https://osv.dev/vulnerability/CVE-2020-10986 · Vendor Advisory
• https://t.me/cvenotify/4979 · Telegram Post
• https://ise.io/research · Note