Tenda AC15 Command Injection Vulnerability in USB Unload Function

A command injection vulnerability has been identified in the Tenda AC15 router, specifically in the goform/formsetUsbUnload endpoint of version V15.03.05.18_multi. The vulnerability arises because the 'v1' parameter is not properly validated, allowing for potentially malicious commands to be executed via the doSystemCmd function.

Impact

Exploitation of this vulnerability allows for arbitrary command execution on the affected device.

Reproduction

To reproduce this vulnerability, send a POST request to the '/goform/setUsbUnload' endpoint with an injected payload in the 'deviceName' parameter. The injected command will be executed on the device, demonstrating the command injection flaw.