PT-2024-8613 · Tenda · Tenda Ac6

Theraz0R

·

Published

2024-08-13

·

Updated

2025-04-05

·

CVE-2024-10697

CVSS v3.1

9.8

Critical

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions Tenda AC6 version 15.03.05.19
Description A critical issue has been found in the formWriteFacMac() function of the /goform/WriteFacMac API endpoint. The manipulation of the mac parameter leads to command injection. This issue can be exploited remotely. The exploit has been disclosed to the public and may be used.
Recommendations For Tenda AC6 version 15.03.05.19, as a temporary workaround, consider disabling the formWriteFacMac() function until a patch is available. Restrict access to the /goform/WriteFacMac API endpoint to minimize the risk of exploitation. Avoid using the mac parameter in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Special Elements Injection

Command Injection

Weakness Enumeration

CWE-74CWE-77

Related Identifiers

BDU:2024-10187
CVE-2024-10697

Affected Products

Tenda Ac6