CVE-2020-15916

goform/AdvSetLanip endpoint on Tenda AC15 AC1900 15.03.05.19 devices allows remote attackers to execute arbitrary system commands via shell metacharacters in the lanIp POST parameter.

Score

CVSS 3.1 9.8 Critical

Status

Modified - cve@mitre.org

Published

2020-07-23

Last modified

2024-08-04

Weaknesses

CWE-78

Affected products

• Ac15 Firmware (Tenda)

References

• https://blog.securityevaluators.com/tenda-ac1900-vulnerabilities-discovered-and-exploited-e8e26aa0bc68