VulnerabilityModified
CVE-2023-23080
Certain Tenda products are vulnerable to command injection.
CRITICAL 9.8EPSS 2.46%
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (2.46%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Certain Tenda products are vulnerable to command injection. This affects Tenda CP7 Tenda CP7<=V11.10.00.2211041403 and Tenda CP3 v.10 Tenda CP3 v.10<=V20220906024_2025 and Tenda IT7-PCS Tenda IT7-PCS<=V2209020914 and Tenda IT7-LCS Tenda IT7-LCS<=V2209020914 and Tenda IT7-PRS Tenda IT7-PRS<=V2209020908.
- CVSS 3.1
- 9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 2.46% probability · 84th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-77
- Affected
- tenda/it7-lcs firmware · tenda/it7-pcs firmware · tenda/it7-prs firmware · tenda/cp3 firmware · tenda/cp7 firmware
- Source
- cve@mitre.org
References
- https://github.com/fxc233/iot-vul/tree/main/Tenda/IPCExploit, Third Party Advisory
- https://github.com/fxc233/iot-vul/tree/main/Tenda/IPCExploit, Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.