by Kastro
Paper/Archive/CVE-2024-9793

CVE-2024-9793

Tenda AC1206 — Tenda AC1206 ate ate_ifconfig_set command injection

EPSS 23%public exploitCVSS 9.8
critical.is priorityof 100
59
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 97.8.978 × 2019.6Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

A vulnerability classified as critical was found in Tenda AC1206 up to 15.03.06.23. This vulnerability affects the function ate_iwpriv_set/ate_ifconfig_set of the file /goform/ate. The manipulation leads to command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Affected

ProductAffectedFixed inSource
AC120615.03.06.0–CNA
AC120615.03.06.1–CNA
AC120615.03.06.2–CNA
AC120615.03.06.3–CNA
AC120615.03.06.4–CNA
AC120615.03.06.5–CNA
AC120615.03.06.6–CNA
AC120615.03.06.7–CNA
AC120615.03.06.8–CNA
AC120615.03.06.9–CNA
AC120615.03.06.10–CNA
AC120615.03.06.11–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
VulDB (CNA)6.3CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
VulDB (CNA)6.3CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
VulDB (CNA)5.3CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
CISA ADPSSVCExploitation: poc · Automatable: no · Technical impact: partial

References

writeupvuldb.com/?id.279946refvuldb.com/?ctiid.279946writeupvuldb.com/?submit.418061refgithub.com/ixout/iotVuls/blob/main/Tenda/ac1206_004/report.mdexploitgithub.com/ixout/iotVuls/blob/main/Tenda/ac1206_003/report.mdreftenda.com.cn