CVE-2019-5071

An exploitable command injection vulnerability exists in the /goform/WanParameterSetting functionality of Tenda AC9 Router AC1200 Smart Dual-Band Gigabit WiFi Route (AC9V1.0 Firmware V15.03.05.16multiTRU). A specially crafted HTTP POST request can cause a command injection in the DNS1 post parameters, resulting in code execution. An attacker can send HTTP POST request with command to trigger this vulnerability.

Score
CVSS 3.1 7.8 High
Status
Modified - talos-cna@cisco.com
Published
2019-11-21
Last modified
2024-08-04
Weaknesses
CWE-78

Affected products

References

 
 
© AVABIS GmbH privacypolicy about