Cyber Posture

CVE-2026-24101

CriticalPublic PoC

Published: 02 March 2026

Published
02 March 2026
Modified
03 March 2026
KEV Added
—
Patch
—
CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0125 79.4th percentile
Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Description

An issue was discovered in goform/formSetIptv in Tenda AC15V1.0 V15.03.05.18_multi. When the condition is met, `s1_1` will be passed into sub_B0488, concatenated into `doSystemCmd`. The value of s1_1 is not validated, potentially leading to a command injection vulnerability.

Mitigating Controls (NIST 800-53 r5)AI

SI-10 Information Input Validation good match
prevent

Directly requires validation of untrusted inputs like s1_1 prior to concatenation into system commands, preventing command injection exploits.

SI-2 Flaw Remediation good match
prevent

Mandates timely identification, reporting, and patching of the specific command injection flaw in the Tenda firmware.

IA-8 Identification and Authentication (Non-organizational Users) good match
prevent

Enforces identification and authentication for non-organizational users accessing the goform/formSetIptv endpoint, blocking unauthenticated remote attacks.

Security SummaryAI

CVE-2026-24101 is a command injection vulnerability (CWE-78) discovered in the goform/formSetIptv component of Tenda AC15 V1.0 firmware version V15.03.05.18_multi. The issue arises when a specific condition is met, allowing the unvalidated parameter s1_1 to be passed into the sub_B0488 function and concatenated into the doSystemCmd function, enabling arbitrary command execution.

The vulnerability has a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating it is exploitable remotely over the network with low complexity, requiring no authentication, privileges, or user interaction. An unauthenticated attacker can inject and execute arbitrary commands on the affected device, potentially compromising confidentiality, integrity, and availability to a high degree.

Mitigation details are available in vendor-provided resources, including Tenda's official material at https://www.tenda.com.cn/material/show/2710. Additional technical analysis and reporting can be found in the GitHub repository at https://github.com/akuma-QAQ/CVEreport/tree/main/D-link/CVE-2026-24101.

Details

CWE(s)
CWE-78

Affected Products

tenda
ac15 firmware
15.03.05.18_multi

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1210 Exploitation of Remote Services Lateral Movement
Adversaries may exploit remote services to gain unauthorized access to internal systems once inside of a network.
attack.mitre.org →
T1059.004 Unix Shell Execution
Adversaries may abuse Unix shell commands and scripts for execution.
attack.mitre.org →
Why these techniques?

Unauthenticated remote command injection in public-facing web component (goform) enables exploitation of public-facing application (T1190), remote services (T1210), and Unix shell execution (T1059.004).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References