CVE-2024-34338

Tenda O3V2 with firmware versions V1.0.0.10 and V1.0.0.12 was discovered to contain a Blind Command Injection via dest parameter in /goform/getTraceroute. This vulnerability allows attackers to execute arbitrary commands with root privileges. Authentication is required to exploit this vulnerability.

• CWE-77

• http://exzettabyte.me/blind-command-injection-in-tenda-o3v2Exploit, Third Party Advisory
• http://exzettabyte.me/blind-command-injection-in-tenda-o3v2Exploit, Third Party Advisory

Published

May 14, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-3433A vulnerability classified as problematic has been found in …5.4
• CVE-2024-34331A lack of code signature verification in Parallels Desktop f…9.8
• CVE-2024-34332An issue in SiSoftware SANDRA v31.66 (SANDRA.sys 15.18.1.1) …7.8
• CVE-2024-34334ORDAT FOSS-Online before v2.24.01 was discovered to contain …7.5
• CVE-2024-34335ORDAT FOSS-Online before version 2.24.01 was discovered to c…6.1
• CVE-2024-34336User enumeration vulnerability in ORDAT FOSS-Online before v…5.3
• CVE-2024-3434A vulnerability classified as critical was found in CP Plus …5.4
• CVE-2024-34340Cacti provides an operational monitoring and fault managemen…9.1
• CVE-2024-34341Trix is a rich text editor. The Trix editor, versions prior …5.4
• CVE-2024-34342react-pdf displays PDFs in React apps. If PDF.js is used to …7.1
• CVE-2024-34343Nuxt is a free and open-source framework to create full-stac…6.1
• CVE-2024-34344Nuxt is a free and open-source framework to create full-stac…8.8