Tenda HG10 Command Injection Vulnerability in Boa Web Server

A command injection vulnerability has been identified in the Tenda HG10 AC1200 Dualband Wi-Fi xPON ONT router, specifically in the Boa web server's 'formSysCmd' interface. The issue arises from inadequate input validation and filtering of the 'sysCmd' parameter, allowing attackers to inject arbitrary system commands through specially crafted requests. This vulnerability can be exploited remotely, and an exploit is publicly available.

Impact

Exploitation of this vulnerability allows for arbitrary command execution on the affected device.

Reproduction

The vulnerability can be reproduced by sending a request to the '/boaform/formSysCmd' endpoint with a crafted 'sysCmd' parameter. The injected command will be executed by the system and the output will be redirected to '/tmp/syscmd.log'.