CVE-2021-45401

CRITICAL

Tenda AC10U V1.0 Firmware V15.03.06.49_multi - OS Command Injection via setUsbUnload deviceName Parameter

Title source: llm

Description

A Command injection vulnerability exists in Tenda AC10U AC1200 Smart Dual-band Wireless Router AC10U V1.0 Firmware V15.03.06.49_multi via the setUsbUnload functionality. The vulnerability is caused because the client controlled "deviceName" value is passed directly to the "doSystemCmd" function.

References (1)

Core 1

Core References

Exploit, Third Party Advisory x_refsource_misc

https://github.com/Quadron-Research-Lab/Hardware-IoT/blob/main/Tenda_AC10U_command_injection_RCE.pdf

View Exploit ZIP pw:eip

Scores

CVSS v3 9.8

EPSS 0.0253

EPSS Percentile 82.9%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE

CWE-77

Status published

Products (1)

tendacn/ac10u_firmware 15.03.06.49_multi

Published Feb 18, 2022

Tracked Since Feb 18, 2026