Cyber Resilience

CVE-2024-50852

HighPublic PoCRCE

Published: 13 November 2024

Published
13 November 2024
Modified
21 November 2024
KEV Added
—
Patch
—
CVSS Score v3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0508 90.0th percentile
Risk Priority 21 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-50852 is a high-severity Command Injection (CWE-77) vulnerability in Tendacn G3 Firmware. Its CVSS base score is 8.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 10.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

Deeper analysis

Tenda G3 v3.0 running firmware version 15.11.0.20 contains a command injection vulnerability in the formSetUSBPartitionUmount function. The flaw is tracked as CVE-2024-50852 with CVSS 8.8 and is associated with CWE-77 and CWE-78, indicating improper neutralization of special elements used in OS commands.

An authenticated attacker with network access can supply crafted input to the affected function, resulting in arbitrary command execution on the device. The attack requires low privileges and no user interaction, enabling full compromise of confidentiality, integrity, and availability on the router.

The sole public reference is a technical write-up hosted on GitHub that documents the vulnerable endpoint and reproduction steps; no vendor advisory or firmware patch is referenced in the available sources.

EPSS for the CVE rose from a low baseline after disclosure to a peak of 0.1055 on 2025-12-11 before receding to the current value of 0.0508, indicating a temporary increase in exploitation interest following public release.

EU & UK References

Vulnerability details

Tenda G3 v3.0 v15.11.0.20 was discovered to contain a command injection vulnerability via the formSetUSBPartitionUmount function.

CWE(s)
CWE-77CWE-78

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1059.008 Network Device CLI Execution
Adversaries may abuse scripting or built-in command line interpreters (CLI) on network devices to execute malicious command and payloads.
attack.mitre.org →
Why these techniques?

Command injection vulnerability in the web interface (formSetUSBPartitionUmount) of the Tenda G3 router enables exploitation of a public-facing application (T1190) for remote command execution on a network device (T1059.008).

Affected Assets

tendacn
g3 firmware
15.11.0.20

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

SC-27 Platform-independent Applications
addresses: CWE-78

Platform-independent apps typically execute inside a managed runtime or sandbox that restricts direct OS command execution, reducing the ability to exploit OS command injection.

SI-10 Information Input Validation
addresses: CWE-78

Validates inputs to block special elements that would alter OS command execution.

References