Tenda AC15 Command Injection Vulnerability in goform/formSetIptv

A command injection vulnerability has been identified in the Tenda AC15 router, specifically in the firmware version V15.03.05.18_multi. The issue arises within the goform/formSetIptv endpoint, where the parameter s1_1 is passed to a function without proper validation. This lack of input sanitization could allow an attacker to inject and execute arbitrary commands on the device.

Impact

Exploitation of this vulnerability could lead to unauthorized command execution on the affected router.

Reproduction

To reproduce this vulnerability, send a POST request to the /goform/formSetIptv endpoint. Include the s1_1 parameter with a value that contains the desired command payload. The injected command will be executed on the router's system.