Vulnerability · Published Apr 15, 2021 · Assigned by mitre

CVE-2021-27691

Critical 9.8

In plain English

A critical-severity security flaw in the affected software. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 25.4% (higher than 98% of all known vulnerabilities).

Severity (CVSS NVD)9.8Critical

Exploit odds (30 days)25.4%top 2.0% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

Command Injection in Tenda G0 routers with firmware versions v15.11.0.6(9039)_CN and v15.11.0.5(5876)_CN , and Tenda G1 and G3 routers with firmware versions v15.11.0.17(9502)_CN or v15.11.0.16(9024)_CN allows remote attackers to execute arbitrary OS commands via a crafted action/setDebugCfg request. This occurs because the "formSetDebugCfg" function executes glibc's system function with untrusted input.

Affected products (as reported)

Vendor	Product	Versions
n/a	n/a	n/a

References

https://hackmd.io/%40aZYpdinUS2SD-yhAeHwOkw/rkhTCGzMd x_refsource_MISC