CVE-2023-2649

A vulnerability was found in Tenda AC23 16.03.07.45_cn. It has been declared as critical. This vulnerability affects unknown code of the file /bin/ate of the component Service Port 7329. The manipulation of the argument v2 leads to command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-228778 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

• CWE-77

• https://github.com/xinzhihen06/ac23tenda/blob/main/tendaAC23.mdExploit, Third Party Advisory
• https://vuldb.com/?ctiid.228778Third Party Advisory
• https://vuldb.com/?id.228778Third Party Advisory
• https://github.com/xinzhihen06/ac23tenda/blob/main/tendaAC23.mdExploit, Third Party Advisory
• https://vuldb.com/?ctiid.228778Third Party Advisory
• https://vuldb.com/?id.228778Third Party Advisory

Published

May 11, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-26484KubeVirt is a virtual machine management add-on for Kubernet…8.2
• CVE-2023-26485cmark-gfm is GitHub's fork of cmark, a CommonMark parsing an…7.5
• CVE-2023-26486Vega is a visualization grammar, a declarative format for cr…6.1
• CVE-2023-26487Vega is a visualization grammar, a declarative format for cr…6.1
• CVE-2023-26488OpenZeppelin Contracts is a library for secure smart contrac…6.5
• CVE-2023-26489wasmtime is a fast and secure runtime for WebAssembly. In af…9.9
• CVE-2023-26490mailcow is a dockerized email package, with multiple contain…8.8
• CVE-2023-26491RSSHub is an open source and extensible RSS feed generator. …6.1
• CVE-2023-26492Directus is a real-time API and App dashboard for managing S…7.5
• CVE-2023-26493Cocos Engine is an open-source framework for building 2D & 3…8.8
• CVE-2023-26494lorawan-stack is an open source LoRaWAN network server. Prio…6.1
• CVE-2023-26495An issue was discovered in Open Design Alliance Drawings SDK…7.8