CVE-2024-10697

medium · 5.3

A vulnerability has been found in Tenda AC6 15.03.05.19 and classified as critical. Affected by this vulnerability is the function formWriteFacMac of the file /goform/WriteFacMac of the component API Endpoint. The manipulation of the argument mac leads to command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.

5.3

CVSS

26.2%

EPSS (exploit prob.)

98th

EPSS percentile

2024-11-02

Published

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weaknesses

CWE-74CWE-77

Affected products

Vendor	Product	Affected versions
tenda	ac6_firmware	15.03.05.19
tenda	ac6	all versions

Check a specific version with /api/v1/cve/match.

References

https://github.com/theRaz0r/iot-mycve/blob/main/tenda_ac6_rce_WriteFacMac/tenda_ac6_rce_WriteFacMac.md
https://vuldb.com/?ctiid.282865
https://vuldb.com/?id.282865
https://vuldb.com/?submit.434934
https://www.tenda.com.cn/

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2024-10697