Tenda HG10 Command Injection Vulnerability in Login Interface

A command injection vulnerability has been identified in the Tenda HG10 AC1200 Dualband Wi-Fi xPON ONT router, specifically in the Boa web server's formLogin interface. The issue arises in the checkUserFromLanOrWan function, where the Host parameter is not properly validated, allowing remote attackers to inject and execute arbitrary system commands. This vulnerability affects the firmware version US_HG7_HG9_HG10re_300001138_en_xpon.

Impact

Exploitation of this vulnerability allows for arbitrary command execution on the affected device.

Reproduction

The vulnerability can be reproduced by sending a request to the Tenda HG10 router's login interface with a crafted Host parameter. The injected command will be executed on the device, as confirmed by the creation of a directory named 'hahaha' on the device's file system.