CVE-2018-14558: Tenda AC7, AC9, and AC10 Routers Command Injection Vulnerability
An issue was discovered on Tenda AC7 devices with firmware through V15.03.06.44CN(AC7), AC9 devices with firmware through V15.03.05.19(6318)CN(AC9), and AC10 devices with firmware through V15.03.06.23CN(AC10). A command Injection vulnerability allows attackers to execute arbitrary OS commands via a crafted goform/setUsbUnload request. This occurs because the "formsetUsbUnload" function executes a dosystemCmd function with untrusted input.
Other sources
Tenda AC7, AC9, and AC10 devices contain a command injection vulnerability due to the "formsetUsbUnload" function executes a dosystemCmd function with untrusted input. Successful exploitation allows an attacker to execute OS commands via a crafted goform/setUsbUnload request.
— CISA
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2018-14558.
Which devices are affected by this vulnerability?
Tenda AC7, AC9, and AC10 Routers are affected by this vulnerability.
What is the severity level of CVE-2018-14558?
The severity level of CVE-2018-14558 is critical (9.8).
How can an attacker exploit this vulnerability?
An attacker can exploit this vulnerability by executing arbitrary OS commands.
Is there a fix available for CVE-2018-14558?
Yes, Tenda has released firmware updates to fix CVE-2018-14558. It is recommended to update your devices with the latest firmware.