Vulnerability Details CVE-2019-5072
An exploitable command injection vulnerability exists in the /goform/WanParameterSetting functionality of Tenda AC9 Router AC1200 Smart Dual-Band Gigabit WiFi Route (AC9V1.0 Firmware V15.03.05.16multiTRU). A specially crafted HTTP POST request can cause a command injection in the DNS2 post parameters, resulting in code execution. An attacker can send HTTP POST request with command to trigger this vulnerability.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.007
EPSS Ranking 71.2%
CVSS Severity
CVSS v3 Score 7.8
CVSS v2 Score 4.6
References
Products affected by CVE-2019-5072
-
cpe:2.3:h:tendacn:ac1200_smart_dual-band_gigabit_wifi:-
-
cpe:2.3:o:tendacn:ac9v1.0_firmware:15.03.05.14_en
-
cpe:2.3:o:tendacn:ac9v1.0_firmware:15.03.05.16multitru