The vulnerability resides in the goform/formSetIptv handler of Tenda AC15 routers. An unvalidated input parameter, s1_1, is concatenated directly into a system command string, allowing an attacker to inject arbitrary OS commands. This flaw can lead to remote execution of arbitrary code on the device, compromising confidentiality, integrity, and availability.

The flaw affects Tenda AC15 routers running firmware version 15.03.05.18_multi (v1.0). The affected hardware is the AC15 model; the exact firmware identifier is ac15_firmware:15.03.05.18_multi.

The CVSS base score is 9.8, indicating critical severity. The EPSS score of 1% suggests a non-negligible chance of exploitation in the near term. No listing in CISA KEV does not diminish the risk. Although the attack vector is not explicitly described, it is inferred to be via the router’s web interface which is typically exposed on the local network, allowing any user who can reach the interface to send crafted requests. The lack of input validation directly into system command execution makes the vulnerability highly exploitable.