CVE-2024-36604

Tenda O3V2 v1.0.0.12(3880) was discovered to contain a Blind Command Injection via stpEn parameter in the SetStp function. This vulnerability allows attackers to execute arbitrary commands with root privileges.

Score

CVSS 3.1 9.8 Critical

Status

Analyzed - cve@mitre.org

Published

2024-06-04

Last modified

2025-02-13

Weaknesses

CWE-77

Affected products

• O3 Firmware (Tenda)
• O3v2 Firmware (Tenda)

References

• https://exzettabyte.me/blind-command-injection-in-stp-service-on-tenda-o3v2/