CVE-2023-2649
Published: 11 May 2023
Summary
CVE-2023-2649 is a high-severity Command Injection (CWE-77) vulnerability in Tenda Ac23 Firmware. Its CVSS base score is 7.2 (High).
Operationally, ranked in the top 4.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
CVE-2023-2649 is a command injection vulnerability affecting Tenda AC23 routers running firmware version 16.03.07.45_cn. It resides in unknown code within the /bin/ate binary that listens on service port 7329, where unsanitized input supplied to the v2 argument is passed directly to a system command interpreter, corresponding to CWE-77.
An attacker with administrative credentials can exploit the flaw over the network to inject and execute arbitrary operating-system commands on the device. Successful exploitation grants full control over confidentiality, integrity, and availability of the router, consistent with the CVSS 7.2 rating that requires high privileges but no user interaction.
Public exploit code has been published on GitHub, and the vendor was notified prior to disclosure but provided no response or patch. The associated EPSS score has remained flat at 0.1784 with no material increase since publication.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-34115
Vulnerability details
A vulnerability was found in Tenda AC23 16.03.07.45_cn. It has been declared as critical. This vulnerability affects unknown code of the file /bin/ate of the component Service Port 7329. The manipulation of the argument v2 leads to command injection. The…
more
attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-228778 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.