Vulnerability Spotlight: Tenda AC9 /goform/Wan Parameter Setting command injection vulnerability

Summary: Cisco Talos discovered a command injection vulnerability in the Tenda AC9 AC1200 Smart Dual-Band Gigabit WiFi Router, specifically firmware version V15.03.05.16_multi_TRU, in the /goform/WanParameterSetting resource. A locally authenticated attacker can send a specially crafted HTTP POST request to execute arbitrary commands and obtain a reverse shell running as root, and Talos disclosed the flaw after Tenda failed to patch it within Cisco's 90-day deadline.
Why it matters: The exploit yields a root reverse shell on a router Talos describes as one of the most popular and affordable dual-band gigabit WiFi routers sold online, and the vendor missed the 90-day patch deadline, leaving the flaw public with no fix.

Read the original at Cisco Talos ↗

Topics: Malware
Related: ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026
Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026
Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026