CVE-2023-50989

CriticalCVSS 9.8

Published: 20/12/2023(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

High risk

2.01%

79th percentile - higher than 79% of all known CVEs

Summary

A command injection vulnerability was discovered in the Tenda i29 device version V1.0.0.5 within the pingSet function. An attacker can remotely execute arbitrary system commands.

Risk Assessment

The risk for the organization includes potential takeover of the device, leading to network integrity compromise, data leakage, or using the device as an entry point for further attacks.

Recommendation

It is recommended to immediately update the Tenda i29 firmware to the latest version if available, or apply temporary mitigations such as restricting access to the pingSet function to trusted IP addresses only.

Original NVD description (English source)

Tenda i29 v1.0 V1.0.0.5 was discovered to contain a command injection vulnerability via the pingSet function.