CVE-2024-39963 — Command Injection in Ax12 Firmware

CWE-77 — Command Injection3 documents3 sources
Severity
8.0HIGHNVD
EPSS
1.3%
top 20.64%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Tenda Ax12 FirmwareTenda AX9 Firmware
Timeline
PublishedJul 19

Description

AX3000 Dual-Band Gigabit Wi-Fi 6 Router AX9 V22.03.01.46 and AX3000 Dual-Band Gigabit Wi-Fi 6 Router AX12 V1.0 V22.03.01.46 were discovered to contain an authenticated remote command execution (RCE) vulnerability via the macFilterType parameter at /goform/setMacFilterCfg.

CVSS vector

CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 2.1 | Impact: 5.9

Affected Packages2 packages

▶NVDtenda/ax12_firmware22.03.01.46
▶NVDtenda/ax9_firmware22.03.01.46

🔴Vulnerability Details

2
GHSA
GHSA-j9gw-h8vh-cc5r: AX3000 Dual-Band Gigabit Wi-Fi 6 Router AX9 V22↗2024-07-19
▶
CVEList
CVE-2024-39963: AX3000 Dual-Band Gigabit Wi-Fi 6 Router AX9 V22↗2024-07-19
▶
CVE-2024-39963 — Command Injection in Tenda | cvebase