high7.2
CVE-2024-34338
Tenda O3V2 with firmware versions V1.0.0.10 and V1.0.0.12 was discovered to contain a Blind Command Injection via dest parameter in /goform/getTraceroute.
Impact
Tenda O3V2 with firmware versions V1.0.0.10 and V1.0.0.12 was discovered to contain a Blind Command Injection via dest parameter in /goform/getTraceroute. This vulnerability allows attackers to execute arbitrary commands with root privileges. Authentication is required to exploit this vulnerability.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Tenda | O3 Firmware | Versions 1.0.0.10, 1.0.0.12 |