CVE-2026-24101-nvd.nist.gov-Received

An issue was discovered in goform/formSetIptv in Tenda AC15V1.0 V15.03.05.18_multi. When the condition is met, `s1_1` will be passed into sub_B0488, concatenate…

Published:

1 March 2026 at 23:00:00

Alert date:

2 March 2026 at 18:02:45

Source:

nvd.nist.gov

Mobile & IoT, Network Infrastructure

A command injection vulnerability was discovered in Tenda AC15V1.0 router firmware version V15.03.05.18_multi. The vulnerability exists in the goform/formSetIptv function where the s1_1 parameter is passed to sub_B0488 without proper validation. This parameter gets concatenated into doSystemCmd, allowing potential command injection attacks. The lack of input validation enables attackers to execute arbitrary system commands on the affected device.

Technical details

Mitigation steps:

Affected products:

Tenda AC15V1.0