CVE-2024-2853: Tenda AC10U setsambacfg formSetSambaConf os command injection
First published: Sun Mar 24 2024(Updated: )
A vulnerability was found in Tenda AC10U 15.03.06.48/15.03.06.49. It has been rated as critical. This issue affects the function formSetSambaConf of the file /goform/setsambacfg. The manipulation of the argument usbName leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-257777 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Credit: cna@vuldb.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| All of | ||
| Any of | ||
| Tenda AC10U Firmware | =15.03.06.48 | |
| Tenda AC10U Firmware | =15.03.06.49 | |
| Tenda AC10U firmware | =1.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2024-2853?
CVE-2024-2853 has been rated as critical.
Which software versions are affected by CVE-2024-2853?
CVE-2024-2853 affects Tenda AC10U firmware versions 15.03.06.48 and 15.03.06.49.
What type of vulnerability is CVE-2024-2853?
CVE-2024-2853 is an OS command injection vulnerability.
How do I fix CVE-2024-2853?
To fix CVE-2024-2853, update to a patched version of the Tenda AC10U firmware if available.
What is the attack vector for CVE-2024-2853?
The attack for CVE-2024-2853 can be initiated remotely by manipulating the usbName argument.
- agent/weakness
- agent/references
- agent/title
- agent/description
- agent/type
- agent/first-publish-date
- agent/author
- agent/severity
- collector/epss-latest
- source/FIRST
- agent/epss
- agent/softwarecombine
- agent/event
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/source
- agent/tags
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/tenda
- canonical/tenda ac10u firmware
- version/tenda ac10u firmware/15.03.06.48
- version/tenda ac10u firmware/15.03.06.49
- version/tenda ac10u firmware/1.0