CVSS: 9.8EPSS: 0%CPEs: 3EXPL: 1CVE-2024-2853 – Tenda AC10U setsambacfg formSetSambaConf os command injection
https://notcve.org/view.php?id=CVE-2024-2853
A vulnerability was found in Tenda AC10U 15.03.06.48/15.03.06.49. It has been rated as critical. This issue affects the function formSetSambaConf of the file /goform/setsambacfg. The manipulation of the argument usbName leads to os command injection. The attack may be initiated remotely. • https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/AC10U/v1.V15.03.06.48/more/formSetSambaConf.md https://vuldb.com/?ctiid.257777 https://vuldb.com/?id.257777 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 9.8EPSS: 2%CPEs: 6EXPL: 1CVE-2020-22079
https://notcve.org/view.php?id=CVE-2020-22079
Stack-based buffer overflow in Tenda AC-10U AC1200 Router US_AC10UV1.0RTL_V15.03.06.48_multi_TDE01 allows remote attackers to execute arbitrary code via the timeZone parameter to goform/SetSysTimeCfg. Un desbordamiento del búfer en la región stack de la memoria en el router AC-10U AC1200 de Tenda versión US_AC10UV1.0RTL_V15.03.06.48_multi_TDE01, permite a atacantes remotos ejecutar código arbitrario por medio del parámetro timeZone de goform/SetSysTimeCfg • https://cwe.mitre.org/data/definitions/121.html https://github.com/1sd3d/Tendown/tree/master/PoCs/Auth/bof11 https://github.com/Lyc-heng/routers/blob/main/routers/stack1.md • CWE-787: Out-of-bounds Write •