Loading vulnerability…
OS Command Injection in Tenda AC7, AC9, and AC10 Routers
CVE-2018-14558 is an OS command injection vulnerability affecting Tenda AC7 firmware through V15.03.06.44_CN(AC7), AC9 firmware through V15.03.05.19(6318)_CN(AC9), and AC10 firmware through V15.03.06.23_CN(AC10). The formsetUsbUnload function passes untrusted request input to dosystemCmd, allowing a crafted USB-unload request to execute arbitrary operating-system commands. The vulnerability has been exploited for botnet propagation, including by Mirai.TBOT, Moobot, Evooo1Bot, and Dysphoria.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation permits arbitrary operating-system command execution on an affected router and can enable malware installation and attacker control of the device. Observed campaigns have used compromised devices for botnet enrollment. Depending on the deployed malware, subsequent activity can include DDoS attacks, proxying attacker traffic, credential interception, and access to internal networks. The execution privilege level is not specified.
If you can’t patch tonight, do this now.
Disable unnecessary exposed services and restrict network access to router management interfaces. Segment affected IoT devices from critical systems to limit follow-on access. Monitor for suspicious outbound connections, unexpected proxy behavior, and unauthorized persistence mechanisms.
Patch, then assume compromise.
Apply vendor firmware updates that address CVE-2018-14558. A confirmed fixed firmware version is currently not available in the supplied information. Replace exposed or legacy appliances when an appropriate security update is unavailable.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
24 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.