CVE-2017-16923

CVE-2017-16923 describes a critical command injection vulnerability in the app_data_center component of several Tenda AC series routers, including AC9, AC15, and AC18 models. This flaw allows remote, unauthenticated attackers on the local area network (LAN) to execute arbitrary operating system commands by sending a specially crafted GET request to the cgi-bin/luci/usbeject endpoint. The vulnerability stems from the "usbeject_process_entry" function executing a system command with unvalidated user input. With a CVSS v3.0 score of 8.8 (HIGH), this vulnerability poses a significant risk due to its low attack complexity (AC:L) and lack of required privileges (PR:N) or user interaction (UI:N). A successful exploit could lead to complete compromise of the affected device, resulting in high confidentiality, integrity, and availability impacts (C:H/I:H/A:H). While the vulnerability is severe, there is currently no evidence of active exploitation in the wild, and no public exploit code or Metasploit modules are available. Community discussion and media coverage for this CVE are also minimal, suggesting it has not garnered widespread attention.