CVE-2021-45990
📋 TL;DR
This vulnerability allows remote attackers to execute arbitrary commands on Tenda G1 and G3 routers by injecting malicious commands into the pic_name parameter of the uploadPicture function. Attackers can gain full control of affected devices, potentially compromising network security. Users running vulnerable firmware versions are affected.
💻 Affected Systems
- Tenda G1 Router
- Tenda G3 Router
📦 What is this software?
G1 Firmware by Tendacn
G3 Firmware by Tendacn
⚠️ Risk & Real-World Impact
Worst Case
Complete router compromise allowing attackers to intercept all network traffic, install persistent backdoors, pivot to internal networks, and use the router for botnet activities.
Likely Case
Router takeover leading to DNS hijacking, credential theft from network traffic, and installation of malware on connected devices.
If Mitigated
Limited impact if routers are behind firewalls with strict inbound filtering and command injection attempts are blocked.
🎯 Exploit Status
Public proof-of-concept code exists in GitHub repositories. Exploitation requires network access to router web interface.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Later versions than v15.11.0.17(9502)_CN
Vendor Advisory: Not publicly documented by Tenda
Restart Required: Yes
Instructions:
1. Log into router admin interface. 2. Navigate to firmware update section. 3. Download latest firmware from Tenda website. 4. Upload and apply firmware update. 5. Reboot router after update completes.
🔧 Temporary Workarounds
Disable Remote Management
allPrevent external access to router web interface
Network Segmentation
allIsolate router management interface to trusted network
🧯 If You Can't Patch
- Replace affected routers with non-vulnerable models
- Deploy network firewall rules to block all inbound traffic to router web interface
🔍 How to Verify
Check if Vulnerable:
Check router firmware version in admin interface. If version is exactly v15.11.0.17(9502)_CN, device is vulnerable.Check Version:
Login to router web interface and check System Status or Firmware Information pageVerify Fix Applied:
Verify firmware version has changed from v15.11.0.17(9502)_CN to a newer version.📡 Detection & Monitoring
Log Indicators:
- Unusual command execution in router logs
- Multiple failed upload attempts to uploadPicture endpoint
- Suspicious file uploads with shell metacharacters in filenames
Network Indicators:
- HTTP POST requests to uploadPicture with shell commands in parameters
- Outbound connections from router to suspicious IPs
SIEM Query:
source="router_logs" AND ("uploadPicture" OR "pic_name") AND ("|" OR ";" OR "$" OR "`")