Sign-up

ID

VAR-202411-0021


CVE

CVE-2024-10697


TITLE

Shenzhen Tenda Technology Co.,Ltd.  of  AC6  Command injection vulnerability in firmware

Trust: 0.8

sources: JVNDB: JVNDB-2024-011818

DESCRIPTION

A vulnerability has been found in Tenda AC6 15.03.05.19 and classified as critical. Affected by this vulnerability is the function formWriteFacMac of the file /goform/WriteFacMac of the component API Endpoint. The manipulation of the argument The leads to command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Shenzhen Tenda Technology Co.,Ltd. of AC6 Firmware contains a command injection vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. The vulnerability is caused by the parameter The failing to properly filter special characters and commands in the constructed command. Attackers can exploit this vulnerability to cause arbitrary command execution

Trust: 2.16

sources: NVD: CVE-2024-10697 // JVNDB: JVNDB-2024-011818 // CNVD: CNVD-2024-44861

IOT TAXONOMY

category:['Network device']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2024-44861

AFFECTED PRODUCTS

vendor:tendamodel:ac6scope:eqversion:15.03.05.19

Trust: 1.6

vendor:tendamodel:ac6scope: - version: -

Trust: 0.8

vendor:tendamodel:ac6scope:eqversion:ac6 firmware 15.03.05.19

Trust: 0.8

vendor:tendamodel:ac6scope:eqversion: -

Trust: 0.8

sources: CNVD: CNVD-2024-44861 // JVNDB: JVNDB-2024-011818 // NVD: CVE-2024-10697

CVSS

SEVERITY

CVSSV2

CVSSV3

cna@vuldb.com: CVE-2024-10697
value: MEDIUM

Trust: 1.0

nvd@nist.gov: CVE-2024-10697
value: CRITICAL

Trust: 1.0

OTHER: JVNDB-2024-011818
value: CRITICAL

Trust: 0.8

CNVD: CNVD-2024-44861
value: HIGH

Trust: 0.6

cna@vuldb.com: CVE-2024-10697
severity: MEDIUM
baseScore: 6.5
vectorString: AV:N/AC:L/AU:S/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 8.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.0

OTHER: JVNDB-2024-011818
severity: MEDIUM
baseScore: 6.5
vectorString: AV:N/AC:L/AU:S/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: NONE
impactScore: NONE
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.8

CNVD: CNVD-2024-44861
severity: HIGH
baseScore: 10.0
vectorString: AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 10.0
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

cna@vuldb.com: CVE-2024-10697
baseSeverity: MEDIUM
baseScore: 6.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: LOW
exploitabilityScore: 2.8
impactScore: 3.4
version: 3.1

Trust: 1.0

nvd@nist.gov: CVE-2024-10697
baseSeverity: CRITICAL
baseScore: 9.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 3.9
impactScore: 5.9
version: 3.1

Trust: 1.0

NVD: JVNDB-2024-011818
baseSeverity: CRITICAL
baseScore: 9.8
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: CNVD: CNVD-2024-44861 // JVNDB: JVNDB-2024-011818 // NVD: CVE-2024-10697 // NVD: CVE-2024-10697

PROBLEMTYPE DATA

problemtype:CWE-77

Trust: 1.0

problemtype:Command injection (CWE-77) [NVD evaluation ]

Trust: 0.8

problemtype: Command injection (CWE-77) [ others ]

Trust: 0.8

sources: JVNDB: JVNDB-2024-011818 // NVD: CVE-2024-10697

PATCH

title:Patch for Tenda AC6 Command Injection Vulnerability (CNVD-2024-44861)url:https://www.cnvd.org.cn/patchInfo/show/618226

Trust: 0.6

sources: CNVD: CNVD-2024-44861

EXTERNAL IDS

db:NVDid:CVE-2024-10697

Trust: 3.2

db:VULDBid:282865

Trust: 1.6

db:JVNDBid:JVNDB-2024-011818

Trust: 0.8

db:CNVDid:CNVD-2024-44861

Trust: 0.6

sources: CNVD: CNVD-2024-44861 // JVNDB: JVNDB-2024-011818 // NVD: CVE-2024-10697

REFERENCES

url:https://github.com/theraz0r/iot-mycve/blob/main/tenda_ac6_rce_writefacmac/tenda_ac6_rce_writefacmac.md

Trust: 1.8

url:https://vuldb.com/?submit.434934

Trust: 1.8

url:https://www.tenda.com.cn/

Trust: 1.8

url:https://vuldb.com/?id.282865

Trust: 1.6

url:https://vuldb.com/?ctiid.282865

Trust: 1.0

url:https://nvd.nist.gov/vuln/detail/cve-2024-10697

Trust: 0.8

sources: CNVD: CNVD-2024-44861 // JVNDB: JVNDB-2024-011818 // NVD: CVE-2024-10697

SOURCES

db:CNVDid:CNVD-2024-44861
db:JVNDBid:JVNDB-2024-011818
db:NVDid:CVE-2024-10697

LAST UPDATE DATE

2024-11-15T23:23:49.982000+00:00


SOURCES UPDATE DATE

db:CNVDid:CNVD-2024-44861date:2024-11-14T00:00:00
db:JVNDBid:JVNDB-2024-011818date:2024-11-05T02:02:00
db:NVDid:CVE-2024-10697date:2024-11-04T14:18:20.337

SOURCES RELEASE DATE

db:CNVDid:CNVD-2024-44861date:2024-11-14T00:00:00
db:JVNDBid:JVNDB-2024-011818date:2024-11-05T00:00:00
db:NVDid:CVE-2024-10697date:2024-11-02T12:15:15.780