CVE-2020-15916

Name of the Vulnerable Software and Affected Versions Tenda AC15 AC1900 version 15.03.05.19

Description The issue concerns the "goform/AdvSetLanip" endpoint, which allows remote attackers to execute arbitrary system commands. This is achieved by injecting shell metacharacters into the lanIp POST parameter.

Recommendations For version 15.03.05.19, as a temporary workaround, consider restricting access to the "goform/AdvSetLanip" endpoint until a patch is available. Avoid using the lanIp parameter in the affected endpoint until the issue is resolved.