Vulnerability · Published Oct 10, 2024 · Assigned by VulDB

CVE-2024-9793Tenda AC1206 ate ate_ifconfig_set command injection

Medium 6.3

In plain English

A medium-severity command injection in AC1206 from Tenda. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 23.1% (higher than 98% of all known vulnerabilities).

Severity (CVSS 3.1)6.3Medium

Exploit odds (30 days)23.1%top 2.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A vulnerability classified as critical was found in Tenda AC1206 up to 15.03.06.23. This vulnerability affects the function ate_iwpriv_set/ate_ifconfig_set of the file /goform/ate. The manipulation leads to command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Affected products (as reported)

Vendor	Product	Versions
Tenda	AC1206	15.03.06.015.03.06.115.03.06.215.03.06.315.03.06.415.03.06.515.03.06.615.03.06.7

Weakness: CWE-77 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

References

VDB-279946 | Tenda AC1206 ate ate_ifconfig_set command injection vdb-entry, technical-description
VDB-279946 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
Submit #418061 | Tenda Router V15.03.06.23 and earlier Command Injection third-party-advisory
https://github.com/ixout/iotVuls/blob/main/Tenda/ac1206_004/report.md related
https://github.com/ixout/iotVuls/blob/main/Tenda/ac1206_003/report.md exploit
https://www.tenda.com.cn/ product