CVE-2024-2812

A vulnerability was found in Tenda AC15 15.03.05.18/15.03.20_multi. It has been classified as critical. This affects the function formWriteFacMac of the file /goform/WriteFacMac. The manipulation of the argument mac leads to os command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-257667. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

• CWE-78

• https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/AC15/V1.0%20V15.03.20_multi/formWriteFacMac.mdExploit, Third Party Advisory
• https://vuldb.com/?ctiid.257667Permissions Required
• https://vuldb.com/?id.257667Third Party Advisory
• https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/AC15/V1.0%20V15.03.20_multi/formWriteFacMac.mdExploit, Third Party Advisory
• https://vuldb.com/?ctiid.257667Permissions Required
• https://vuldb.com/?id.257667Third Party Advisory

Published

Mar 22, 2024

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-28114Peering Manager is a BGP session management tool. There is a…9.1
• CVE-2024-28115FreeRTOS is a real-time operating system for microcontroller…7.8
• CVE-2024-28116Grav is an open-source, flat-file content management system.…8.8
• CVE-2024-28117Grav is an open-source, flat-file content management system.…8.8
• CVE-2024-28118Grav is an open-source, flat-file content management system.…8.8
• CVE-2024-28119Grav is an open-source, flat-file content management system.…8.8
• CVE-2024-28120codeium-chrome is an open source code completion plugin for …7.5
• CVE-2024-28121stimulus_reflex is a system to extend the capabilities of bo…8.8
• CVE-2024-28122 JWX is Go module implementing various JWx (JWA/JWE/JWK/JWS/…6.8
• CVE-2024-28123Wasmi is an efficient and lightweight WebAssembly interprete…9.8
• CVE-2024-28125FitNesse all releases allows a remote authenticated attacker…9.8
• CVE-2024-28126Cross-site scripting vulnerability exists in 0ch BBS Script …6.1