CVE-2018-16334

HIGH

Tenda AC10 Firmware < 15.03.06.23 and AC9 Firmware - OS Command Injection via MAC Parameter

Title source: llm

Description

An issue was discovered on Tenda AC9 V15.03.05.19(6318)_CN and AC10 V15.03.06.23_CN devices. The mac parameter in a POST request is used directly in a doSystemCmd call, causing OS command injection.

References (1)

Core 1

Core References

Exploit, Third Party Advisory x_refsource_misc

https://github.com/zsjevilhex/iot/blob/master/route/tenda/tenda-04/tenda.md

Scores

CVSS v3 8.8

EPSS 0.0362

EPSS Percentile 88.1%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Details

CWE

CWE-78

Status published

Products (2)

tendacn/ac10_firmware < 15.03.06.23

tendacn/ac9_firmware 15.03.05.19

Published Sep 02, 2018

Tracked Since Feb 18, 2026