Volerion logoVolerion
Volerion logoVolerion

Tenda AC9 Command Injection Vulnerability in the IPTV Configuration Handler

Vulnerability

A critical command injection vulnerability has been identified in the Tenda AC9 router, specifically in the firmware version 15.03.02.13. The issue arises within the 'formSetIptv' function of the '/goform/SetIPTVCfg' POST request handler. The vulnerability allows for remote exploitation by manipulating the 'list' parameter, which is not properly sanitized before being used in command execution.

Impact

Exploitation of this vulnerability allows for arbitrary command execution on the affected device.

Added: Sep 1, 2025, 7:22 PM
Updated: Sep 1, 2025, 7:22 PM

Vulnerability Rating

Custom Algorithm
spread
0.3
impact
7.5
exploitability
6.2
remediation
0.0
relevance
0.1
threat
6.5
urgency
2.9
incentive
0.8

Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.