CVE-2025-10442
A vulnerability was determined in Tenda AC9 and AC15 15.03.05.14. This affects the function formexeCommand of the file /goform/exeCommand. T
CVSS
6.3
Medium
EPSS
9.2%
p95
KEV
—
Exploit Today
29
0-100
Published: Sep 15, 2025 · Last modified: Oct 18, 2026 · CWE-77 · CWE-78
8.7%EPSS · 30 days9.4%
2026-10-142026-11-11
A vulnerability was determined in Tenda AC9 and AC15 15.03.05.14. This affects the function formexeCommand of the file /goform/exeCommand. This manipulation of the argument cmdinput causes os command injection. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized.
- github.comhttps://github.com/2664521593/mycve/blob/main/Tenda/Tenda_AC9_CJ.md
- github.comhttps://github.com/2664521593/mycve/blob/main/Tenda/Tenda_AC9_CJ.md#poc
- vuldb.comhttps://vuldb.com/?ctiid.323876
- vuldb.comhttps://vuldb.com/?id.323876
- vuldb.comhttps://vuldb.com/?submit.647838
- vuldb.comhttps://vuldb.com/?submit.647839
- www.tenda.com.cnhttps://www.tenda.com.cn/
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-758698.8 HIG—
———Zohocorp ManageEngine DDI Central versions below 6301 is affected by an authorization bypass and PowerShell command injection vulnerability that allowed authenticated non-administrative users to target unauthorized Windows DHCP subnets and potentially execute arbitrary commands on managed Windows DHCP servers through crafted DNS suffix values.8hCVE-2026-194218.8 HIG—
——0Zohocorp ManageEngine DDI Central versions below 6301 is affected by a PowerShell injection vulnerability due to insufficient validation of user-supplied TXT record values in Windows DNS operations.9hCVE-2026-1011078.0 HIG—
——0An OS command Injection issue exists in Air Terminal 6 provided by SoftBank Corp. Arbitrary commands may be executed with the root privilege by a user who can log in to the web management console of the affected product.15hCVE-2026-757857.2 HIG—
——0An improper neutralization of special elements used in an OS command vulnerability in the VPN API in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote authenticated users with administrator privileges to read or write arbitrary files and conduct denial-of-service attacks.17hCVE-2026-659528.5 HIG—
——0Improper neutralization of special elements used in an OS command in the remote SSH operation functionality of Lenovo XClarity Essentials OneCLI 5.5.0 for Linux could allow an attacker to execute arbitrary OS commands with the privileges of the configured SSH account on a managed server by supplying a specially crafted remote path.23hCVE-2026-659497.2 HIG—
——0Improper neutralization of special elements used in an OS command in Lenovo XClarity Integrator for Microsoft Windows Admin Center 5.1.1 and 5.2.0 allows an authenticated remote attacker to execute arbitrary PowerShell commands by submitting a crafted hostname.23h