CVE-2026-7469
Command Injection in Tenda 4G300 Router
Publication date: 2026-04-30
Last updated on: 2026-04-30
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| tenda | 4g300_firmware | 1.01.42_cn_tdc01 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-77 | The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component. |
| CWE-74 | The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Tenda 4G300 US_4G300V1.0Mt_V1.01.42_CN_TDC01 device, specifically in the function sub_425A28 of the file /goform/DelFil.
It is caused by improper handling of the argument 'delflag', which allows an attacker to perform command injection.
This means that an attacker can remotely execute arbitrary commands on the device by manipulating this argument.
The exploit for this vulnerability is publicly available.
How can this vulnerability impact me? :
This vulnerability can allow a remote attacker to execute arbitrary commands on the affected device.
Such command injection can lead to unauthorized control over the device, potentially resulting in data compromise, disruption of service, or further attacks within the network.
How can this vulnerability impact me? :
The vulnerability allows remote attackers to inject and execute arbitrary commands on the affected device. This can lead to unauthorized control over the device, potentially compromising its functionality, stealing data, or using the device as a foothold for further attacks within a network.
Can you explain this vulnerability to me?
This vulnerability exists in the Tenda 4G300 device, specifically in the function sub_425A28 within the /goform/DelFil file. It involves the manipulation of the argument 'delflag' which leads to command injection. This means an attacker can remotely execute arbitrary commands on the device by exploiting this flaw.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability involves command injection via the manipulation of the argument delflag in the /goform/DelFil function on Tenda 4G300 devices. Detection can focus on monitoring network traffic for suspicious requests targeting the /goform/DelFil endpoint with unusual or crafted delflag parameters.
You can use network monitoring tools like tcpdump or Wireshark to capture HTTP requests to the device and filter for requests containing /goform/DelFil.
- tcpdump -i <interface> -A -s 0 'tcp port 80 and (((ip dst <device_ip>) and (tcp[((tcp[12:1] & 0xf0) >> 2):4] = 0x47455420))' | grep '/goform/DelFil'
- Use curl or wget to test the endpoint manually by sending crafted requests to see if command injection is possible (only in a controlled environment).
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include restricting remote access to the affected Tenda 4G300 device, especially blocking access to the /goform/DelFil endpoint from untrusted networks.
Ensure that the device firmware is updated to the latest version if a patch is available from the vendor.
If patching is not immediately possible, consider disabling or restricting the vulnerable functionality or placing the device behind a firewall that blocks suspicious requests.
Monitor logs and network traffic for signs of exploitation attempts.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The provided information does not specify how the vulnerability in Tenda 4G300 firmware impacts compliance with common standards and regulations such as GDPR or HIPAA.