critical9.8Known exploited
CVE-2018-14558
Tenda AC7, AC9, and AC10 Routers Command Injection Vulnerability
Exploited in the wild
This vulnerability is on a Known Exploited Vulnerabilities catalogue, added 2021-11-03. Federal due date: 2022-05-03.
Apply updates per vendor instructions.
Impact
An issue was discovered on Tenda AC7 devices with firmware through V15.03.06.44_CN(AC7), AC9 devices with firmware through V15.03.05.19(6318)_CN(AC9), and AC10 devices with firmware through V15.03.06.23_CN(AC10). A command Injection vulnerability allows attackers to execute arbitrary OS commands via a crafted goform/setUsbUnload request. This occurs because the "formsetUsbUnload" function executes a dosystemCmd function with untrusted input.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Tenda | Ac7 Firmware | through 15.03.06.44_cn |
| Tenda | Ac9 Firmware | through 15.03.05.19\(6318\)_cn |
| Tenda | Ac10 Firmware | through 15.03.06.23_cn |