Описание
Tenda O3V2 with firmware versions V1.0.0.10 and V1.0.0.12 was discovered to contain a Blind Command Injection via dest parameter in /goform/getTraceroute. This vulnerability allows attackers to execute arbitrary commands with root privileges. Authentication is required to exploit this vulnerability.
Ссылки
- ExploitThird Party Advisory
- ExploitThird Party Advisory
Уязвимые конфигурации
Конфигурация 1
Одновременно
cpe:2.3:o:tenda:o3_firmware:1.0.0.10:*:*:*:*:*:*:*
cpe:2.3:h:tenda:o3:2.0:*:*:*:*:*:*:*
Конфигурация 2
Одновременно
cpe:2.3:o:tenda:o3_firmware:1.0.0.12:*:*:*:*:*:*:*
cpe:2.3:h:tenda:o3:2.0:*:*:*:*:*:*:*
EPSS
Процентиль: 85%
0.02548
Низкий
7.2 High
CVSS3
Дефекты
CWE-77
Связанные уязвимости
CVSS3: 7.2
github
больше 1 года назад
A Blind command injection vulnerability in Tenda O3V2 V1.0.0.12 and earlier allows remote attackers to execute operating system commands via dest parameter in /goform/getTraceroute
EPSS
Процентиль: 85%
0.02548
Низкий
7.2 High
CVSS3
Дефекты
CWE-77