Skip to content
Sign in
7.8 High

CVE-2019-5072 An exploitable command injection vulnerability exists in the /goform/WanParameterSetting functionality of Tenda AC9…

Description

An exploitable command injection vulnerability exists in the /goform/WanParameterSetting functionality of Tenda AC9 Router AC1200 Smart Dual-Band Gigabit WiFi Route (AC9V1.0 Firmware V15.03.05.16multiTRU). A specially crafted HTTP POST request can cause a command injection in the DNS2 post parameters, resulting in code execution. An attacker can send HTTP POST request with command to trigger this vulnerability.

Affected products and versions

Product Affected versions Fixed in
Tenda AC9 Versions not published

Other CVEs of Tenda AC9

The 2 CVEs of Tenda AC9 →
CVE-2019-5071 An exploitable command injection vulnerability exists in the /goform/WanParameterSetting functionality of Tenda AC9… 7.8 High
Track this CVE