CVE-2024-2854: falha de média gravidade em Tenda AC18
Tenda AC18 setsambacfg formSetSambaConf os command injection
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 6.3epss 3.9%
A vulnerability classified as critical has been found in Tenda AC18 15.03.05.05. Affected is the function formSetSambaConf of the file /goform/setsambacfg. The manipulation of the argument usbName leads to os command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-257778 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Produtos afetados
Tenda · AC18CVEs relacionadas — Tenda AC18
No mesmo produto, das mais perigosas para as menos.
CVE-2025-0528HIGHTenda AC8/AC10/AC18 HTTP Request telnet command injectionEPSS 6.2%CVE-2025-5606MEDIUMTenda AC18 SetIPTVCfg formSetIptv command injectionEPSS 3.8%CVE-2025-11121MEDIUMTenda AC18 AdvSetLanip command injectionEPSS 3.7%CVE-2024-2485HIGHTenda AC18 SetSpeedWan formSetSpeedWan stack-based overflowEPSS 1.7%CVE-2024-2490HIGHTenda AC18 openSchedWifi setSchedWifi stack-based overflowEPSS 1.6%CVE-2024-2489HIGHTenda AC18 SetNetControlList formSetQosBand stack-based overflowEPSS 1.6%