Description
Tenda AC9存在命令注入漏洞。该漏洞是由于应用在处理ntpServer参数时校验不足导致的。
Tenda AC9 SetSysTimeCfg 命令注入漏洞
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://nvd.nist.gov/vuln/detail/cve-2022-36273
https://cvefeed.io/vuln/detail/CVE-2022-36273
https://www.clouddefense.ai/cve/2022/CVE-2022-36273
https://cvepremium.circl.lu/vuln/cve-2022-36273
https://www.fortiguard.com/encyclopedia/ips/52023
https://github.com/advisories/GHSA-95rc-v396-9w7m
https://strobes.co/vi/cve/CVE-2022-27022/
https://vulmon.com/searchpage?q=tenda+ac9+firmware+15.03.2.21+cn
https://app.opencve.io/cve/?product=ac9&vendor=tenda
https://blog.talosintelligence.com/vulnerability-spotlight-tenda-ac9-command-nov-2019/