CVE-2026-24105: Tenda AC15 Command Injection Vulnerability

CVE-2026-24105 Overview

A critical command injection vulnerability has been discovered in the Tenda AC15V1 wireless router, specifically within the goform/formsetUsbUnload endpoint. The vulnerability exists due to insufficient input validation of the v1 parameter, which is subsequently passed to the doSystemCmd function without proper sanitization. This flaw allows unauthenticated remote attackers to execute arbitrary system commands on the affected device, potentially leading to complete device compromise.

Critical Impact

Unauthenticated remote attackers can execute arbitrary commands on vulnerable Tenda AC15V1 routers, enabling complete device takeover, network pivoting, and persistent backdoor installation.

Affected Products

• Tenda AC15V1.0 V15.03.05.18_multi firmware

Discovery Timeline

• 2026-03-02 - CVE-2026-24105 published to NVD
• 2026-03-03 - Last updated in NVD database

Technical Details for CVE-2026-24105

Vulnerability Analysis

This vulnerability is classified under CWE-94 (Improper Control of Generation of Code), specifically manifesting as a command injection flaw. The vulnerable endpoint goform/formsetUsbUnload is designed to handle USB device unmounting operations on the router. However, the implementation fails to properly validate or sanitize user-supplied input before incorporating it into system command execution.

The v1 parameter, which appears to be intended for specifying USB device information, is passed directly to the doSystemCmd function. This function likely executes shell commands on the underlying Linux-based operating system running on the router. Without proper input validation, an attacker can inject arbitrary shell metacharacters and commands that will be executed with the privileges of the web server process, typically root on embedded devices.

Root Cause

The root cause of this vulnerability is the absence of input validation on the v1 parameter within the formsetUsbUnload form handler. The application directly incorporates untrusted user input into a system command string without sanitizing shell metacharacters such as semicolons (;), pipes (|), backticks (`), or command substitution syntax ($()). This is a classic example of improper input validation leading to command injection in embedded device firmware.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker with network access to the router's web management interface can craft a malicious HTTP request to the goform/formsetUsbUnload endpoint with a specially crafted v1 parameter containing shell commands.

The exploitation mechanism involves injecting shell metacharacters followed by arbitrary commands. For example, an attacker could terminate the intended command and append their own malicious command using semicolons or other command separators. Given the network-accessible nature of router web interfaces (often exposed on LAN and sometimes WAN), this vulnerability presents a significant risk for both internal network compromise and internet-facing attacks.

Technical details and proof-of-concept information can be found in the GitHub CVE Report Repository. Additional product information is available in the Tenda Material Documentation.

Detection Methods for CVE-2026-24105

Indicators of Compromise

• HTTP POST requests to /goform/formsetUsbUnload containing shell metacharacters (;, |, &, `, $()) in the v1 parameter
• Unusual outbound network connections from the router to external IP addresses
• Unexpected processes running on the router that persist across reboots
• Modified configuration files or new user accounts on the device
• DNS query anomalies indicating command-and-control communication

Detection Strategies

• Deploy network intrusion detection signatures to identify malicious requests targeting goform/formsetUsbUnload with command injection patterns
• Monitor HTTP traffic to router management interfaces for suspicious payloads containing shell metacharacters
• Implement web application firewall rules to block requests with command injection patterns in form parameters
• Utilize SentinelOne Singularity for IoT to detect anomalous behavior on network devices

Monitoring Recommendations

• Enable logging on all router management interface access and review logs for suspicious request patterns
• Monitor for unusual network traffic originating from router devices, particularly reverse shell connections
• Implement network segmentation to limit access to router management interfaces from untrusted networks
• Deploy honeypot routers with the vulnerable firmware to detect active exploitation attempts in your environment

How to Mitigate CVE-2026-24105

Immediate Actions Required

• Restrict network access to the router's web management interface using firewall rules or access control lists
• Disable remote management features if not required for operations
• Implement network segmentation to isolate router management interfaces from untrusted network segments
• Monitor for firmware updates from Tenda and apply them immediately when available

Patch Information

As of the last NVD update on 2026-03-03, no official patch information has been published by Tenda. Affected organizations should monitor the Tenda Material Documentation for firmware updates addressing this vulnerability. Until a patch is available, implement the workarounds described below to reduce exposure.

Workarounds

• Block external access to the router's web management interface at the network perimeter
• Implement strict firewall rules allowing only trusted IP addresses to access the management interface on port 80/443
• Consider deploying a network-based web application firewall to filter malicious requests targeting the vulnerable endpoint
• If possible, disable the USB functionality on the router through the management interface to reduce the attack surface
• Evaluate replacing affected devices with alternative router hardware from vendors with better security track records

# Example iptables rules to restrict management interface access
# Only allow management access from trusted admin subnet
iptables -A INPUT -p tcp --dport 80 -s 192.168.1.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -s 192.168.1.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -j DROP