Tenda AC10 Command Injection Vulnerability Allowing Arbitrary Command Execution

A command injection vulnerability has been identified in the Tenda AC10 router, specifically in version V1.0 V15.03.06.23. The issue arises in the formexeCommand function, where the cmdinput parameter from a POST request is improperly handled. This parameter is assigned to the cmd_buf variable, which is then used in the doSystemCmd function, leading to arbitrary command execution on the device.

Impact

Exploitation of this vulnerability allows for arbitrary command execution on the affected device.

Reproduction

To reproduce this vulnerability, send a POST request to the router's web interface that includes a crafted cmdinput parameter. The input will be processed by the formexeCommand function, which will then execute the injected command on the system via the doSystemCmd function.