MEDIUM
Tenda AC6 API Endpoint WriteFacMac formWriteFacMac command injection
Published Nov 2, 2024
5.3
MEDIUMCVSS 4.0
EPSS 26.17%
Description
A vulnerability has been found in Tenda AC6 15.03.05.19 and classified as critical. Affected by this vulnerability is the function formWriteFacMac of the file /goform/WriteFacMac of the component API Endpoint. The manipulation of the argument mac leads to command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
Affected products
-
- Version 15.03.05.19StatusaffectedConstraints-
- Version
AND
- 15.03.05.19
-
- Version 15.03.05.19StatusaffectedConstraints-
- Version
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| Tenda | Ac6 Firmware | n/a |
|
No Red Hat product state for this CVE.
No package ranges for this CVE.
Remediation
No remediation recorded yet.
References (6)
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-33251 Advisory
- https://github.com/theRaz0r/iot-mycve/blob/main/tenda_ac6_rce_WriteFacMac/tenda_ac6_rce_WriteFacMac.md exploitThird Party Advisory
- https://vuldb.com/?ctiid.282865 signaturepermissions-requiredPermissions RequiredThird Party Advisory
- https://vuldb.com/?id.282865 vdb-entrytechnical-descriptionPermissions RequiredThird Party Advisory
- https://vuldb.com/?submit.434934 third-party-advisoryThird Party Advisory
- https://www.tenda.com.cn/ product
| Link | Providers | Tags |
|---|---|---|
| https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-33251 | Advisory | |
| https://github.com/theRaz0r/iot-mycve/blob/main/tenda_ac6_rce_WriteFacMac/tenda_ac6_rce_WriteFacMac.md | exploitThird Party Advisory | |
| https://vuldb.com/?ctiid.282865 | signaturepermissions-requiredPermissions RequiredThird Party Advisory | |
| https://vuldb.com/?id.282865 | vdb-entrytechnical-descriptionPermissions RequiredThird Party Advisory | |
| https://vuldb.com/?submit.434934 | third-party-advisoryThird Party Advisory | |
| https://www.tenda.com.cn/ | product |
Change history (0)
No recorded changes yet.
Sources
CVE.org / MITRE
Status PUBLISHED
Assigner VulDB
Published Nov 2, 2024
Updated Apr 5, 2025
Reserved Nov 1, 2024
Link CVE-2024-10697
CISA Vulnrichment
Updated Nov 5, 2024
ENISA EUVD
EUVD-2024-33251 Assigner VulDB
Published Nov 2, 2024
Updated Apr 5, 2025
Exploited since n/a
Link EUVD-2024-33251