CVE-2021-45401: Command Injection

Published Feb 18, 2022

Updated

A Command injection vulnerability exists in Tenda AC10U AC1200 Smart Dual-band Wireless Router AC10U V1.0 Firmware V15.03.06.49multi via the setUsbUnload functionality. The vulnerability is caused because the client controlled "deviceName" value is passed directly to the "doSystemCmd" function.

Affected Software

2 affected components

Tendacn Ac10u Firmware=15.03.06.49_multi

Tendacn Ac10u=1.0

Event History

Feb 18, 2022

CVE Published

via MITRE·05:31 PM

Data Sourced

via MITRE·05:31 PM

Description

Frequently Asked Questions

What is the vulnerability ID for this command injection vulnerability?

The vulnerability ID for this command injection vulnerability is CVE-2021-45401.

What is the affected software?

The affected software is Tenda AC10U AC1200 Smart Dual-band Wireless Router AC10U V1.0 Firmware V15.03.06.49_multi.

What is the severity of CVE-2021-45401?

The severity of CVE-2021-45401 is critical with a CVSS score of 9.8.

How does this vulnerability occur?

This vulnerability occurs due to a command injection in the setUsbUnload functionality, where a client-controlled value is passed directly to the doSystemCmd function.

Is there a fix available for this vulnerability?

There is no information available about a fix for this vulnerability. It is recommended to contact the vendor for further information.