← Advisories

Tenda HG6 v3.3.0 Remote Command Injection Vulnerability

High
Advisory ID
ZSL-2022-5706
Release Date
03 May 2022
Vendor
Tenda Technology Co.,Ltd. - https://www.tendacn.com
Affected Version
Firmware version: 3.3.0-210926, Software version: v1.1.0, Hardware Version: v1.0, Check Version: TD_HG6_XPON_TDE_ISP
Tested On
Boa/0.93.15
Summary

HG6 is an intelligent routing passive optical network terminal in Tenda FTTH solution. HG6 provides 4 LAN ports(1*GE,3*FE), a voice port to meet users' requirements for enjoying the Internet, HD IPTV and VoIP multi-service applications.

Description

The application suffers from an authenticated OS command injection vulnerability. This can be exploited to inject and execute arbitrary shell commands through the 'pingAddr' and 'traceAddr' HTTP POST parameters in formPing, formPing6, formTracert and formTracert6 interfaces.

Proof of Concept
Disclosure Timeline
22.04.2022Vulnerability discovered.
26.04.2022Vendor contacted.
01.05.2022No response from the vendor.
03.05.2022Public security advisory released.
Credits
Vulnerability discovered by Gjoko Krstic
References
Changelog
03.05.2022Initial release
09.05.2022Added reference [1], [2], [3] and [4]
13.05.2022Added reference [5]
29.05.2022Added reference [6] and [7]