CVE-2024-9793

Tenda AC1206 routers running firmware up to and including 15.03.06.23 are affected by an OS command injection flaw (CWE-77/CWE-78) in the ate_iwpriv_set and ate_ifconfig_set handlers of the /goform/ate endpoint. An attacker can trigger it remotely by submitting crafted input to this web interface, which the router passes to shell commands without adequate sanitization; the CVSS 4.0 vector (PR:L) indicates low-privilege authentication is required. Successful exploitation allows execution of arbitrary commands on the router, which can lead to full device compromise and a foothold on the local network. All Tenda AC1206 deployments on firmware up to 15.03.06.23 are affected. Public proof-of-concept exploits have been published, there is no confirmed in-the-wild exploitation yet, and the vendor was notified but did not respond, so no fixed firmware is confirmed.

What to do: Do not expose the router's web management interface (including /goform/ate) to the internet, and use strong admin credentials since the attack vector requires authentication. Because Tenda did not respond and no fixed firmware version is confirmed, monitor the vendor for an update and validate whether your deployed firmware is at or below 15.03.06.23; consider testing the published PoC conditions against your devices.