PT-2022-19078 · Tenda · Tenda Ac15

Published 2022-05-04 · Updated 2023-08-08 · CVE-2022-28557

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Tenda AC15 version US AC15V1.0BR V15.03.05.20 multi TDE01.bin

Description The issue is related to a command injection vulnerability at the /goform/setsambacfg interface of the device's web interface. This vulnerability can potentially lead to arbitrary command execution when combined with other vulnerabilities.

Recommendations For Tenda AC15 version US AC15V1.0BR V15.03.05.20 multi TDE01.bin, as a temporary workaround, consider restricting access to the /goform/setsambacfg interface until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2022-28557

Affected Products

Tenda Ac15

References · 3

• 🔥 https://github.com/doudoudedi/TendaAC15_vul/blob/main/TendaAC15-vul.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-28557 · Security Note
• https://osv.dev/vulnerability/CVE-2022-28557 · Vendor Advisory