VYPR
← All advisories
Critical severity9.8CISA KEVNVD Advisory· Published Oct 30, 2018· Updated Jun 17, 2026

CVE-2018-14558

CVE-2018-14558

Description

An issue was discovered on Tenda AC7 devices with firmware through V15.03.06.44_CN(AC7), AC9 devices with firmware through V15.03.05.19(6318)_CN(AC9), and AC10 devices with firmware through V15.03.06.23_CN(AC10). A command Injection vulnerability allows attackers to execute arbitrary OS commands via a crafted goform/setUsbUnload request. This occurs because the "formsetUsbUnload" function executes a dosystemCmd function with untrusted input.

Affected products

6
  • Tenda/Ac10 Firmware
    cpe:2.3:o:tenda:ac10_firmware:*:*:*:*:*:*:*:*
    Range: <=15.03.06.23_cn
  • Tenda/Ac7 Firmware
    cpe:2.3:o:tenda:ac7_firmware:*:*:*:*:*:*:*:*
    Range: <=15.03.06.44_cn
  • Tenda/Ac9 Firmware
    cpe:2.3:o:tenda:ac9_firmware:*:*:*:*:*:*:*:*
    Range: <=15.03.05.19\(6318\)_cn
  • Tenda/AC9llm-fuzzy
    Range: <=V15.03.05.19(6318)_CN
  • Tenda/Ac10llm-fuzzy
    Range: <=V15.03.06.23_CN
  • Tenda/AC7llm-fuzzy
    Range: <=V15.03.06.44_CN

Patches

Vulnerability mechanics

References

2

News mentions

1