PT-2020-14710
CVE-2020-15916
·
تاريخ النشر
2020-07-23
·
تاريخ التحديث
2020-07-27
الوصف من
CVSS 2.0
10
حرجةالمقاييسAV:N/AC:L/Au:N/C:C/I:C/A:C
Name of the Vulnerable Software and Affected Versions
Tenda AC15 AC1900 version 15.03.05.19
Description
The issue concerns the "goform/AdvSetLanip" endpoint, which allows remote attackers to execute arbitrary system commands. This is achieved by injecting shell metacharacters into the
lanIp POST parameter.Recommendations
For version 15.03.05.19, as a temporary workaround, consider restricting access to the "goform/AdvSetLanip" endpoint until a patch is available. Avoid using the
lanIp parameter in the affected endpoint until the issue is resolved. وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾