Tenda AC15 AC1900 USB-Unload OS Command Injection

Successful exploitation provides unauthenticated remote operating-system command execution on the affected router. An attacker can use this access to deploy malware, alter device configuration, establish persistence, proxy or pivot traffic through the device, exfiltrate information accessible to the service, or disrupt router operation. The vulnerability has been exploited in botnet propagation activity.

Restrict access to the router's web-management interface to trusted administrative networks and prevent its exposure to the public internet. Apply strict network segmentation and firewall controls around affected devices. Where a vendor-supported fixed firmware is unavailable, replace the affected router or isolate it from untrusted networks. Monitor for suspicious requests to the USB-unload management function and unexpected command execution or configuration changes on exposed Tenda devices.

Upgrade the affected Tenda AC15 AC1900 firmware to a vendor-fixed release if one is available. If no patched firmware is available, replace the device with a supported model that receives security updates. Review vendor guidance for corrected firmware and remove or retire devices running version 15.03.05.19 from exposed environments.