Tenda AC9 and AC15 OS Command Injection Vulnerability

A command injection vulnerability has been identified in the Tenda AC9 and AC15 routers, specifically in the firmware version 15.03.05.14. The vulnerability arises in the 'formexeCommand' function within the '/goform/exeCommand' file, where the 'cmdinput' parameter is manipulated to execute arbitrary operating system commands. This flaw allows remote attackers to gain full control over the affected device.

Impact

Exploitation of this vulnerability allows for arbitrary command execution on the affected device, leading to complete control over the device by the attacker.

Reproduction

The vulnerability can be reproduced by sending a crafted HTTP request to the '/goform/exeCommand' endpoint, including a 'cmdinput' parameter with a command injection payload. For example, a request could be made to execute a command that creates a file in the '/tmp' directory, such as a file named 'hackac9.txt'.