CVE-2024-2853: Tenda AC10U setsambacfg formSetSambaConf os command injection
A vulnerability was found in Tenda AC10U 15.03.06.48/15.03.06.49. It has been rated as critical. This issue affects the function formSetSambaConf of the file /goform/setsambacfg. The manipulation of the argument usbName leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-257777 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-2853?
CVE-2024-2853 has been rated as critical.
Which software versions are affected by CVE-2024-2853?
CVE-2024-2853 affects Tenda AC10U firmware versions 15.03.06.48 and 15.03.06.49.
What type of vulnerability is CVE-2024-2853?
CVE-2024-2853 is an OS command injection vulnerability.
How do I fix CVE-2024-2853?
To fix CVE-2024-2853, update to a patched version of the Tenda AC10U firmware if available.
What is the attack vector for CVE-2024-2853?
The attack for CVE-2024-2853 can be initiated remotely by manipulating the usbName argument.