PT-2026-22653 · Tenda · Tenda Ac15V1.0

Akuma-Qaq · CVE-2026-24105 · Published 2026-03-02 · Updated 2026-03-06

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Tenda AC15V1.0 versions prior to V15.03.05.18 multi

Description An issue exists in the goform/formsetUsbUnload component of the software. The v1 variable is not properly validated, which could allow for command injection when used with the doSystemCmd function. This could potentially allow an attacker to execute arbitrary commands on the system.

Recommendations Update to a version later than V15.03.05.18 multi.

Exploit

Fix

DoS

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2026-24105

Affected Products

Tenda Ac15V1.0

References · 11

• 🔥 https://github.com/akuma-QAQ/CVEreport/tree/main/D-link/CVE-2026-24105 · Exploit
• https://osv.dev/vulnerability/CVE-2026-24105 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-24105 · Security Note
• https://twitter.com/cracbot/status/2029874884525097402 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2028637476013662208 · Twitter Post
• https://tenda.com.cn/material/show/2710 · Note
• https://twitter.com/CVEnew/status/2028523510142800032 · Twitter Post
• https://t.me/CVEtracker/46132 · Telegram Post
• https://twitter.com/cracbot/status/2029512422105776559 · Twitter Post
• https://twitter.com/infoflowcloud/status/2028526191364177995 · Twitter Post
• https://t.me/cveNotify/153951 · Telegram Post