CVE Vulnerability Advisory Database

Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.

Showing 1–2 of 2 advisories (Page 1/1)

CVE-2021-317559.8/CRITICALEPSS 86.5%CISA KEV

2021-05-07

Tenda AC11 Router /goform/setmac Stack Buffer Overflow Remote Code Execution Vulnerability (CVE-2021-31755) Analysis and Mitigation Guide

[Affected Scope] Tenda AC11 wireless routers running firmware versions up to and including 02.03.01.104_CN

[Impact] Unauthenticated remote attackers can execute arbitrary system commands with root privileges by sending a specially crafted HTTP POST request

[Mitigation] Immediately upgrade to the latest patched firmware version and disable external WAN-side HTTP management interfaces

tenda ac11 stack-buffer-overflow rce cwe-787 kev

Full Advisory & Mitigation

CVE-2018-145589.8/CRITICALEPSS 8.5%CISA KEV

2018-10-30

Tenda AC7 / AC9 / AC10 Routers goform/setUsbUnload Remote Command Injection Vulnerability (CVE-2018-14558) Analysis and Mitigation Guide

[Affected Scope] Tenda AC7 (firmware through V15.03.06.44_CN), AC9 (firmware through V15.03.05.19(6318)_CN), and AC10 (firmware through V15.03.06.23_CN)

[Impact] Unauthenticated remote attackers can execute arbitrary OS commands with root privileges by sending a crafted HTTP request, leading to complete device compromise

[Mitigation] Apply the latest official firmware updates immediately, disable WAN-side remote management, and restrict access to the web interface

command-injection iot-security cwe-78 known-exploited-vulnerability

Full Advisory & Mitigation