CVE-2026-24105

Published: Mar 2, 2026Modified: Mar 6, 2026

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

An issue was discovered in goform/formsetUsbUnload in Tenda AC15V1.0 V15.03.05.18_multi. The value of `v1` was not checked, potentially leading to a command injection vulnerability if injected into doSystemCmd.

Affected (1)

Products: Tenda: Ac15 Firmware

Tenda

1 product

Ac15 Firmware

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Tenda Ac15 Firmware	Version 15.03.05.18

Running on/with	Platform Versions
Tenda Ac15	Version 1.0

Related CWEs

CWE-94

Improper Control of Generation of Code ('Code Injection')

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

References (2)

https://github.com/akuma-QAQ/CVEreport/tree/main/D-link/CVE-2026-24105

Source: cve@mitre.org

ExploitThird Party Advisory

https://www.tenda.com.cn/material/show/2710

Source: cve@mitre.org

Release Notes

Timeline

No history available yet.