CVE-2023-40837

Summary

CVE-2023-40837 is a vulnerability affecting Tenda AC6 US_AC6V1.0BR_V15.03.05.16_multi_TD01.bin firmware. The issue lies in the 'sub_ADD50' function, which contains a command execution vulnerability. In the "formSetIptv" function, attackers can pass unfiltered the "list" and "vlanId" fields as parameters to 'sub_ADD50', enabling them to execute arbitrary commands on the affected device. This vulnerability poses a significant risk, allowing attackers to gain unauthorized access and control over the targeted network.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.