Tenda Technology AC9 Firmware 15.03.05.19

CPE Details

Tenda Technology AC9 Firmware 15.03.05.19
tendacn
ac9_firmware
15.03.05.19
2018-10-24
16h25 +00:00
2021-06-03
16h00 +00:00
CPE NVD
Alerte pour un CPE
Stay informed of any changes for a specific CPE.
Notifications manage

CPE Name: cpe:2.3:o:tendacn:ac9_firmware:15.03.05.19:*:*:*:*:*:*:*

Informations

Vendor

tendacn

Product

ac9_firmware

Version

15.03.05.19

Related CVE

Open and find in CVE List

CVE ID Published Description Score Severity
CVE-2021-31627 2021-10-29 08h32 +00:00 Buffer Overflow vulnerability in Tenda AC9 V1.0 through V15.03.05.19(6318), and AC9 V3.0 V15.03.06.42_multi, allows attackers to execute arbitrary code via the index parameter.
8.8
High
CVE-2021-31624 2021-10-29 08h25 +00:00 Buffer Overflow vulnerability in Tenda AC9 V1.0 through V15.03.05.19(6318), and AC9 V3.0 V15.03.06.42_multi, allows attackers to execute arbitrary code via the urls parameter.
8.8
High
CVE-2018-16333 2018-09-02 01h00 +00:00 An issue was discovered on Tenda AC7 V15.03.06.44_CN, AC9 V15.03.05.19(6318)_CN, AC10 V15.03.06.23_CN, AC15 V15.03.05.19_CN, and AC18 V15.03.05.19(6318)_CN devices. There is a buffer overflow vulnerability in the router's web server. While processing the ssid parameter for a POST request, the value is directly used in a sprintf call to a local variable placed on the stack, which overrides the return address of the function, causing a buffer overflow.
7.5
High
CVE-2018-16334 2018-09-02 01h00 +00:00 An issue was discovered on Tenda AC9 V15.03.05.19(6318)_CN and AC10 V15.03.06.23_CN devices. The mac parameter in a POST request is used directly in a doSystemCmd call, causing OS command injection.
8.8
High
CVE-2018-14492 2018-07-21 12h00 +00:00 Tenda AC7 through V15.03.06.44_CN, AC9 through V15.03.05.19(6318)_CN, and AC10 through V15.03.06.23_CN devices have a Stack-based Buffer Overflow via a long limitSpeed or limitSpeedup parameter to an unspecified /goform URI.
7.5
High
The information presented on CVE Find originates from several carefully selected reference sources. CVE data is provided by MITRE Corporation and the National Vulnerability Database (NVD). The Known Exploited Vulnerabilities (KEV) catalog is sourced from the Cybersecurity and Infrastructure Security Agency (CISA), while EPSS scores come from FIRST.org. Additionally, data regarding software weaknesses (CWE) and common attack patterns (CAPEC) is maintained by MITRE Corporation, and information on hardware and software configurations (CPE) is provided by the NVD.