CVE-2023-40837
CriticalCVSS 9.8Exploitation Probability (EPSS)
Elevated risk53th percentile - higher than 53% of all known CVEs
Summary
The Tenda AC6 device has a command execution vulnerability in the 'sub_ADD50' function. In the 'formSetIptv' function, unfiltered passing of the 'list' and 'vlanId' fields as parameters to the 'sub_ADD50' function allows for command execution.
Risk Assessment
This vulnerability could lead to remote code execution, posing a serious security threat to the organization's network. An attacker could exploit this flaw to gain control over the device.
Recommendation
It is recommended to update the device firmware to the latest version that addresses this vulnerability. Access to functions that could be exploited should also be restricted.
Original NVD description (English source)
Tenda AC6 US_AC6V1.0BR_V15.03.05.16_multi_TD01.bin function 'sub_ADD50' contains a command execution vulnerability. In the "formSetIptv" function, obtaining the "list" and "vlanId" fields, unfiltered passing these two fields as parameters to the "sub_ADD50" function to execute commands.