Vulnerability Details CVE-2024-34338
Tenda O3V2 with firmware versions V1.0.0.10 and V1.0.0.12 was discovered to contain a Blind Command Injection via dest parameter in /goform/getTraceroute. This vulnerability allows attackers to execute arbitrary commands with root privileges. Authentication is required to exploit this vulnerability.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.025
EPSS Ranking 85.0%
CVSS Severity
CVSS v3 Score 7.2
References
Products affected by CVE-2024-34338
-
cpe:2.3:h:tenda:o3:2.0
-
cpe:2.3:o:tenda:o3_firmware:1.0.0.10
-
cpe:2.3:o:tenda:o3_firmware:1.0.0.12