PT-2024-24480 · Tenda · Tenda Ac7

Published 2024-04-17 · Updated 2025-03-17 · CVE-2024-32281

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Tenda AC7V1.0 version 15.03.06.44

Description The issue is a command injection vulnerability in the formexeCommand function via the cmdinput parameter. This vulnerability is remotely exploitable. There are no known exploits at this time.

Recommendations For Tenda AC7V1.0 version 15.03.06.44, patch immediately to address the command injection vulnerability in the formexeCommand function. Additionally, review the code for input validation gaps to prevent similar issues. As a temporary workaround, consider restricting access to the formexeCommand function until a patch is available. Check for unauthorized access after applying the patch.

Exploit

Fix

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

CVE-2024-32281

Affected Products

Tenda Ac7

References · 7

• 🔥 https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/AC7/v1/formexecommand.md · Exploit
• https://osv.dev/vulnerability/CVE-2024-32281 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-32281 · Security Note
• https://twitter.com/oktsec/status/1780653164124873195 · Twitter Post
• https://t.me/cvenotify/115044 · Telegram Post
• https://twitter.com/CVEnew/status/1780731200375828989 · Twitter Post
• https://t.me/cvenotify/77087 · Telegram Post