Threats tagged 'ghsa-g5fj-9fvp-2rvq'

A command injection vulnerability exists in the Tenda 4G300 router firmware version US_4G300V1.0Mt_V1.01.42_CN_TDC01. The flaw affects the function sub_425A28 in the /goform/DelFil endpoint, where manipulation of the 'delflag' argument allows remote attackers to execute arbitrary commands. Public exploit code is available. The vulnerability has a CVSS score of 6.3, indicating medium severity.