CVE-2024-2851: Tenda AC15 setsambacfg formSetSambaConf os command injection
First published: Sun Mar 24 2024(Updated: )
A vulnerability was found in Tenda AC15 15.03.05.18/15.03.20_multi. It has been classified as critical. This affects the function formSetSambaConf of the file /goform/setsambacfg. The manipulation of the argument usbName leads to os command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-257775. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Credit: cna@vuldb.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| All of | ||
| Any of | ||
| Tenda A15 | =15.03.05.18 | |
| Tenda A15 | =15.03.20_multi | |
| Tenda AC15 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2024-2851?
CVE-2024-2851 has been classified as critical due to its potential for OS command injection.
How do I fix CVE-2024-2851?
To fix CVE-2024-2851, update the Tenda AC15 firmware to a version that does not contain this vulnerability.
What systems are affected by CVE-2024-2851?
CVE-2024-2851 affects Tenda AC15 firmware versions 15.03.05.18 and 15.03.20_multi.
What type of vulnerability is CVE-2024-2851?
CVE-2024-2851 is a command injection vulnerability affecting the function formSetSambaConf.
Can CVE-2024-2851 be exploited remotely?
Yes, CVE-2024-2851 can be exploited remotely due to its nature of accepting user input for OS commands.
- agent/title
- agent/weakness
- agent/references
- agent/description
- agent/type
- agent/first-publish-date
- agent/author
- agent/severity
- collector/epss-latest
- source/FIRST
- agent/epss
- agent/event
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/source
- agent/softwarecombine
- agent/tags
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/tenda
- canonical/tenda a15
- version/tenda a15/15.03.05.18
- version/tenda a15/15.03.20_multi
- canonical/tenda ac15