Tenda AC7, AC9, and AC10 Routers Command Injection Vulnerability

CRITIQUE 9.8EXPLOITED (CISA KEV)CVE-2018-14558 · Published 30/10/2018 · updated 17/06/2026

Tenda AC7, AC9, and AC10 Routers Command Injection Vulnerability. Actively exploited: CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on 03/11/2021. Patch affected systems as an emergency.

En bref

CVE-2018-14558 est une vulnérabilité CRITIQUE (CVSS 9.8).
Exploitée activement : la CISA l'a ajoutée au catalogue KEV le 03/11/2021.
Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 8.5%, plus élevée que 95.0% des vulnérabilités.
Aucune version corrigée n'est encore connue : suivez l'avis de l'éditeur dans les références.

Package	Affected versions	Patched versions
AC7, AC9, and AC10 Routers Tenda	Versions not published yet (product named by CISA KEV)

Description

An issue was discovered on Tenda AC7 devices with firmware through V15.03.06.44_CN(AC7), AC9 devices with firmware through V15.03.05.19(6318)_CN(AC9), and AC10 devices with firmware through V15.03.06.23_CN(AC10). A command Injection vulnerability allows attackers to execute arbitrary OS commands via a crafted goform/setUsbUnload request. This occurs because the "formsetUsbUnload" function executes a dosystemCmd function with untrusted input.

References

zsjevilhex/iot · Broken Link
cisa.gov/known-exploited-vulnerabilities-catalog · US Government Resource
CISA KEV · CVE-2018-14558

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free