High severity8.8NVD Advisory· Published Sep 2, 2018· Updated Jun 17, 2026

CVE-2018-16334

Description

An issue was discovered on Tenda AC9 V15.03.05.19(6318)_CN and AC10 V15.03.06.23_CN devices. The mac parameter in a POST request is used directly in a doSystemCmd call, causing OS command injection.

Affected products

Tenda/AC9llm-fuzzy
Range: = V15.03.05.19(6318)_CN
Tenda/AC10llm-fuzzy
Range: = V15.03.06.23_CN

Patches

Vulnerability mechanics

References

github.com/zsjevilhex/iot/blob/master/route/tenda/tenda-04/tenda.mdnvdExploitThird Party Advisory

News mentions

No linked articles in our index yet.

cvss	0.572
epss	0.003
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000