| عنوان | Tenda AC9 AC9V1.0_V15.03.05.19(6318) Command Injection |
|---|
| الوصف | Tenda AC9 V1.0 Router is a consumer-grade wireless router supporting advanced wireless features, firewall, and device management capabilities. A command injection vulnerability exists in the formWriteFacMac function, which handles requests to the /goform/WriteFacMac endpoint. Attackers can inject arbitrary system commands via the mac parameter, leading to unauthorized device control or complete compromise.
The formWriteFacMac function processes POST requests to /goform/WriteFacMac. It extracts the user-controlled mac parameter via sub_2B9D4 (a parameter parsing function) and passes it directly to doSystemCmd. In doSystemCmd, the parameter is interpolated into a system command (e.g., cfm mac %s) without any input sanitization. The command is executed directly on the system. By injecting special characters (e.g., ;), attackers can escape the command context and execute arbitrary system commands on the router. |
|---|
| المصدر | ⚠️ https://github.com/ZZ2266/.github.io/blob/main/Tenda%20AC9/WriteFacMac/readme.md |
|---|
| المستخدم | n0ps1ed (UID 88889) |
|---|
| ارسال | 11/08/2025 04:26 AM (1 سنة منذ) |
|---|
| الاعتدال | 13/08/2025 01:47 PM (2 days later) |
|---|
| الحالة | مكرر |
|---|
| إدخال VulDB | 274875 [Tenda AC9 15.03.06.42 httpd formWriteFacMac تجاوز الصلاحيات] |
|---|
| النقاط | 0 |
|---|