CVE-2026-24101: Tenda AC15 Firmware RCE Vulnerability

CVE-2026-24101 Overview

A critical command injection vulnerability has been identified in the Tenda AC15 wireless router running firmware version V15.03.05.18_multi. The vulnerability exists in the goform/formSetIptv endpoint, where the s1_1 parameter is passed to the sub_B0488 function without proper validation. This unsanitized input is subsequently concatenated into a doSystemCmd call, allowing remote attackers to execute arbitrary operating system commands with the privileges of the router's web service.

Critical Impact

This command injection vulnerability allows unauthenticated remote attackers to execute arbitrary system commands on affected Tenda AC15 routers, potentially leading to complete device compromise, network infiltration, and persistent backdoor installation.

Affected Products

• Tenda AC15 Firmware version 15.03.05.18_multi
• Tenda AC15 Hardware version 1.0

Discovery Timeline

• 2026-03-02 - CVE-2026-24101 published to NVD
• 2026-03-03 - Last updated in NVD database

Technical Details for CVE-2026-24101

Vulnerability Analysis

This vulnerability falls under CWE-78 (Improper Neutralization of Special Elements used in an OS Command), commonly known as OS Command Injection. The flaw exists within the IPTV configuration handler in the router's web management interface.

When a user submits data to the goform/formSetIptv endpoint, the firmware processes the s1_1 parameter through the sub_B0488 function. Under specific conditions, this parameter value is directly concatenated into a system command string executed via doSystemCmd. The absence of input validation or sanitization allows an attacker to inject shell metacharacters and arbitrary commands that will be executed on the underlying operating system.

The vulnerability is particularly dangerous because it can be exploited remotely over the network without requiring any authentication credentials. An attacker with network access to the router's management interface can craft malicious HTTP requests containing shell commands in the s1_1 parameter.

Root Cause

The root cause of this vulnerability is the failure to validate or sanitize user-supplied input before incorporating it into an operating system command. The s1_1 parameter from HTTP requests is directly concatenated into a command string and passed to doSystemCmd without any filtering of dangerous characters such as semicolons, pipes, backticks, or other shell metacharacters. This allows command injection through parameter manipulation.

Attack Vector

The attack is performed remotely over the network by sending a specially crafted HTTP request to the goform/formSetIptv endpoint on the Tenda AC15 router. The attacker injects malicious commands through the s1_1 parameter, which are then executed by the router's underlying Linux operating system. Since no authentication is required, any attacker with network access to the router's web interface can exploit this vulnerability. Successful exploitation grants the attacker the ability to execute arbitrary commands, potentially enabling them to modify router configurations, intercept network traffic, install persistent malware, or use the compromised device as a pivot point for further attacks.

The vulnerability mechanism involves the s1_1 parameter being passed through sub_B0488 and concatenated into a doSystemCmd call. When shell metacharacters are included in this parameter, they are interpreted by the system shell, allowing command injection. For detailed technical analysis and proof-of-concept information, refer to the GitHub PoC Repository.

Detection Methods for CVE-2026-24101

Indicators of Compromise

• Unexpected HTTP requests to /goform/formSetIptv containing shell metacharacters (;, |, $(), backticks) in POST parameters
• Unusual outbound connections from the router to external IP addresses
• Unexpected processes running on the router (detectable via serial console or SSH if available)
• Modified router configuration or firmware
• Presence of unauthorized user accounts or SSH keys on the device

Detection Strategies

• Monitor network traffic for HTTP POST requests to /goform/formSetIptv containing suspicious payloads
• Implement web application firewall (WAF) rules to detect and block command injection patterns targeting the router's web interface
• Deploy network intrusion detection systems (IDS) with signatures for common command injection payloads
• Review router logs for anomalous access patterns or configuration changes

Monitoring Recommendations

• Enable logging on the router if supported and forward logs to a centralized SIEM for analysis
• Monitor for unusual DNS queries or network traffic originating from the router's IP address
• Implement network segmentation to restrict access to the router's management interface
• Conduct regular vulnerability scans of network infrastructure devices

How to Mitigate CVE-2026-24101

Immediate Actions Required

• Restrict access to the router's web management interface to trusted IP addresses only
• Disable remote management if not required
• Place the router behind a firewall that blocks external access to the management interface
• Consider replacing the affected device with a router from a vendor with better security update practices
• Monitor for firmware updates from Tenda that address this vulnerability

Patch Information

Consult the Tenda Security Advisory for official guidance on available patches or firmware updates. At the time of publication, organizations should verify whether updated firmware addressing CVE-2026-24101 is available from the vendor.

Workarounds

• Disable the web management interface entirely if not needed
• Implement strict firewall rules to allow management interface access only from trusted internal hosts
• Use a VPN to access the router's management interface instead of exposing it directly
• Deploy a network-level IPS to filter malicious requests before they reach the router
• Monitor the device closely for signs of compromise until a patch is available

# Example: Restrict management interface access using upstream firewall (iptables)
# Block external access to the router's web interface on port 80/443
iptables -A FORWARD -d <router_ip> -p tcp --dport 80 -j DROP
iptables -A FORWARD -d <router_ip> -p tcp --dport 443 -j DROP
# Allow only specific trusted IP addresses
iptables -I FORWARD -s <trusted_admin_ip> -d <router_ip> -p tcp --dport 80 -j ACCEPT