CVE-2024-2707 is an OS command injection in the Tenda AC10U router firmware 15.03.06.49, in the function formWriteFacMac of /goform/WriteFacMac through the mac argument, scored Medium at 6.3. Severity is Medium at 6.3. No fix is named, and the record says the vendor did not respond to the disclosure.
What's affected
- Tenda AC10U firmware 15.03.06.49 is listed in the record.
- The function is formWriteFacMac, the file is /goform/WriteFacMac and the argument is mac.
- The record says the vendor was contacted early and did not respond, and that the exploit has been disclosed to the public and may be used. The KEV flag is false.
- No fixed version is named in the NVD record. Check the vendor or the advisory linked in Sources before assuming a patch exists.
The NVD record gives a CVSS score of 6.3 with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L. Published 2024-03-20.
How to check if you're exposed
- Read the firmware version on the router's system status page.
- Confirm the admin interface is not reachable from the internet.
- Check the Tenda support site for newer AC10U firmware.
- See VulDB entry VDB-257458 named in the record.
What to do now
- Find AC10U routers on your network.
- Turn off remote administration and limit admin access to a trusted host.
- Install newer firmware if the vendor offers one.
- Use a strong admin password.
- Replace the device if it stays unpatched.
If this software reaches you as part of something you build, the free in-browser dependency scan at gold.safeguard.sh/scan lists known vulnerabilities in your manifests, and reachability analysis helps you see which ones your code can actually trigger.
Why it matters
OS command injection means a value from a request ends up inside a command that the device runs in a shell. If the value is not validated or escaped, the person who supplied it can influence the command. Router firmware is prone to this because many settings pages are thin wrappers around shell commands. The vector shows low privileges required and low impact in each area, which gives 6.3.
The record tags the weakness as CWE-78. See the Gold pages for more on the class.
The record's Known Exploited Vulnerabilities flag is false, so CISA has not listed it as exploited.
Related flaws in the same firmware include CVE-2024-2703, CVE-2024-2704, CVE-2024-2705 and CVE-2024-2706.
Quick check
How is this different from the buffer overflows in the same firmware?
The other related CVEs are memory overflows. This one is command injection, a different weakness, so a memory protection would not stop it.
Sources
I did not retrieve the pages above when preparing this post, either because they blocked automated access or because I relied on the NVD record. The details here come from that record, so read the linked reference for the original wording.
Last reviewed: 19 October 2026.
