CVE-2018-14558: Tenda AC7, AC9, and AC10 Routers Command Injection Vulnerability
Summary: Tenda AC7, AC9, and AC10 routers contain a command injection vulnerability in which the "formsetUsbUnload" function executes a dosystemCmd function with untrusted input. Successful exploitation lets an attacker run OS commands through a crafted goform/setUsbUnload request, and CISA set a remediation due date of 2022-05-03.
What's compelling: This is in CISA's catalog of vulnerabilities known to be exploited in the wild, and the router is the device sitting at the edge of the network - command execution there hands an attacker a foothold behind your perimeter, with ransomware use of this flaw listed as unknown.
Read the original at CISA KEV Catalog ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2018-14558Tenda
- Related
- CVE-2020-10987: Tenda AC1900 Router AC15 Model Remote Code Execution Vulnerability Known Exploited Vulnerabilities · Nov 03, 2021CVE-2021-31755: Tenda AC11 Router Stack Buffer Overflow Vulnerability Known Exploited Vulnerabilities · Nov 03, 2021Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026