ExploitCVE-2024-50853
Improper Neutralization of Special Elements used in a Command ('Command Injection') (CWE-77)
Summary
A command injection vulnerability was discovered in the Tenda G3 v3.0 router running firmware version 15.11.0.20. The vulnerability is specifically located in the formSetDebugCfg function. This vulnerability allows an attacker with access to the adjacent network and low privileges to execute arbitrary commands on the affected device.
Impact
The potential impact of this vulnerability is severe. It could lead to complete compromise of the system's confidentiality, integrity, and availability. An attacker could potentially gain unauthorized access, modify system configurations, or disrupt services running on the affected device. The CVSS base score of 8.0 indicates a high severity, with high impacts on confidentiality, integrity, and availability. The attack vector is from an adjacent network, requires low attack complexity, and no user interaction, making it relatively easy to exploit for an attacker with the right positioning.
Exploitation
One proof-of-concept exploit is available on github.com. There is no evidence of proof of exploitation at the moment.
Patch
As of the current information, there is no mention of an available patch for this vulnerability. Users of the affected Tenda G3 v3.0 router with firmware version 15.11.0.20 should monitor the vendor's website for any security updates or patches that may be released in the future.
Mitigation
Until a patch is available, the following mitigation strategies are recommended: 1. Limit access to the router's management interface to trusted networks only. 2. Implement strong network segmentation to isolate the affected devices. 3. Monitor for any suspicious activities or unauthorized access attempts. 4. If possible, consider replacing the affected router with a more secure alternative. 5. Regularly check for and apply any firmware updates provided by Tenda. 6. Disable remote management features if they are not absolutely necessary.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Timeline
NVD published the first details for CVE-2024-50853
Feedly found the first article mentioning CVE-2024-50853. See article
Feedly estimated the CVSS score as HIGH
A CVSS base score of 8 has been assigned.
EPSS Score was set to: 0.04% (Percentile: 10.1%)