CVE-2024-10697

CVE-2024-10697 is a command injection flaw in the formWriteFacMac handler of the Tenda AC6 router's web API at the /goform/WriteFacMac endpoint, where the 'mac' argument is not properly sanitized before being passed to a system command. A remote attacker who can reach the management interface (the CVSS 4.0 vector rates privileges required as low) can submit a crafted 'mac' value to inject and execute arbitrary operating-system commands on the device. Successful exploitation yields command execution on the router, potentially allowing control of the device, manipulation of traffic, or pivoting to connected clients. The flaw was documented in Tenda AC6 firmware version 15.03.05.19, so owners of this router running that firmware are affected. A public proof-of-concept exploit has been disclosed, and the high EPSS score of 26.2% (98th percentile) suggests a strong likelihood of exploitation attempts within 30 days, though the flaw is not yet in CISA KEV.

What to do: Check your AC6 firmware version and upgrade to the newest Tenda firmware release once available, since 15.03.05.19 is confirmed affected and no fixed version is stated in the advisory. Until patched, disable WAN-side/remote administration, restrict access to the management interface with firewall rules, and consider filtering or monitoring requests to /goform/WriteFacMac. Watch for exploitation attempts that pass unusual or overly long values in the 'mac' parameter.