Tenda AC15 1.0

There is a command injection vulnerability at the /goform/setsambacfg interface of Tenda AC15 US_AC15V1.0BR_V15.03.05.20_multi_TDE01.bin device web, which can also cooperate with CVE-2021-44971 to cause unconditional arbitrary command execution

Multiple Tenda devices are affected by authentication bypass, such as AC15V1.0 Firmware V15.03.05.20_multi?AC5V1.0 Firmware V15.03.06.48_multi and so on. an attacker can obtain sensitive information, and even combine it with authenticated command injection to implement RCE.

Tenda AC15 SetFirewallCfg formSetFirewallCfg stack-based overflow

An issue was discovered in goform/formsetUsbUnload in Tenda AC15V1.0 V15.03.05.18_multi. The value of `v1` was not checked, potentially leading to a command injection vulnerability if injected into doSystemCmd.

An issue was discovered in goform/formSetIptv in Tenda AC15V1.0 V15.03.05.18_multi. When the condition is met, `s1_1` will be passed into sub_B0488, concatenated into `doSystemCmd`. The value of s1_1 is not validated, potentially leading to a command injection vulnerability.

Tenda AC15 expandDlnaFile formExpandDlnaFile stack-based overflow

Tenda AC15 QuickIndex formQuickIndex stack-based overflow

Tenda AC15 addWifiMacFilter stack-based overflow

Tenda AC15 WifiWpsOOB formWifiWpsOOB stack-based overflow

Tenda AC15 saveParentControlInfo stack-based overflow

Tenda AC15 SetSysTimeCfg fromSetSysTime stack-based overflow

Tenda AC15 V1.0BR_V15.03.05.18_multi_TD01 was discovered to contain a buffer overflow via the function FUN_00010e34().

A buffer overflow vulnerability was discovered in goform/formSetMacFilterCfg in Tenda AC15V1.0 V15.03.05.18_multi.

Tenda AC15 HTTP POST Request SetLEDCf formsetschedled buffer overflow

Tenda AC15 POST Request setcfm formSetCfm memory corruption

Tenda AC15 HTTP POST Request SetRemoteWebCfg formSetSafeWanWebMan stack-based overflow

Tenda AC15 HTTP POST Request AdvSetLanip fromadvsetlanip buffer overflow

Tenda AC15 HTTP POST Request setPptpUserList formSetPPTPUserList buffer overflow

Tenda AC15 WriteFacMac formWriteFacMac os command injection

Tenda AC15V1.0 V15.03.20_multi has a command injection vulnerability via the deviceName parameter.

Tenda AC15 US_AC15V1.0BR_V15.03.05.20_multi_TDE01.bin is vulnerable to Buffer Overflow. The stack overflow vulnerability lies in the /goform/setpptpservercfg interface of the web. The sent post data startip and endip are copied to the stack using the sanf function, resulting in stack overflow. Similarly, this vulnerability can be used together with CVE-2021-44971