PT-2018-14606
CVE-2018-18728
·
Publicado
2018-10-28
·
Atualizado
2019-10-03
Descrição por
CVSS 3.1
9.8
CríticaMétricasAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions
Tenda AC9 version 15.03.05.19(6318) CN
Tenda AC15 version 15.03.05.19 CN
Tenda AC18 version 15.03.05.19(6318) CN
Description
An issue allows remote code execution via shell metacharacters in the
usbName field to the fastcall function with a POST request.Recommendations
For Tenda AC9 version 15.03.05.19(6318) CN, avoid using the
usbName field in the affected API endpoint until the issue is resolved.
For Tenda AC15 version 15.03.05.19 CN, restrict access to the fastcall function to minimize the risk of exploitation.
For Tenda AC18 version 15.03.05.19(6318) CN, consider disabling the fastcall function until a patch is available.Explorabilidade
Exploit
Correção
Impactos
Fornecedores
Produtos afetados
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾