CVE-2024-53944

An issue was discovered on Tuoshi/Dionlink LT15D 4G Wi-Fi devices through M7628NNxlSPv2xUI_v1.0.1802.10.08_P4 and LT21B devices through M7628xUSAxUIv2_v1.0.1481.15.02_P0. A unauthenticated remote attacker with network access can exploit a command injection vulnerability. The /goform/formJsonAjaxReq endpoint fails to sanitize shell metacharacters sent via JSON parameters, thus allowing attackers to execute arbitrary OS commands with root privileges.

• CWE-94

• http://www.tuoshi.net/productview.asp?id=218
• http://www.tuoshi.net/productview.asp?id=226
• https://github.com/actuator/cve/blob/main/Tuoshi/CVE-2024-53944-Whitepaper.pdf
• https://github.com/actuator/cve/blob/main/Tuoshi/CVE-2024-53944.txt
• https://github.com/actuator/cve/blob/main/Tuoshi/Firmware-M7628NNxISPv2xUI_v1.0.1802.10.08_P4-Blind-CMD-Injection-unauth-WAN.gif
• https://github.com/actuator/cve/blob/main/Tuoshi/CVE-2024-53944-Whitepaper.pdf

Published

Feb 27, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-53939An issue was discovered in Victure RX1800 WiFi 6 Router (sof…8.8
• CVE-2024-5394A vulnerability was found in itsourcecode Online Student Enr…8.8
• CVE-2024-53940An issue was discovered in Victure RX1800 WiFi 6 Router (sof…8.8
• CVE-2024-53941An issue was discovered in Victure RX1800 WiFi 6 Router (sof…8.8
• CVE-2024-53942An issue was discovered on NRadio N8-180 NROS-1.9.2.n3.c5 de…4.8
• CVE-2024-53943An issue was discovered in NRadio N8-180 NROS-1.9.2.n3.c5 de…6.1
• CVE-2024-53945The KuWFi 4G AC900 LTE router 1.0.13 is vulnerable to comman…8.8
• CVE-2024-53946The KuWFi 4G LTE AC900 router 1.0.13 is vulnerable to Cross-…8.8
• CVE-2024-53947Improper Neutralization of Special Elements used in an SQL C…9.8
• CVE-2024-53948Generation of Error Message Containing analytics metadata In…5.3
• CVE-2024-53949Improper Authorization vulnerability in Apache Superset when…6.5
• CVE-2024-5395A vulnerability was found in itsourcecode Online Student Enr…8.8