Security readout for executives and security teams
Plain-English summary
CVE-2023-37144 concerns a reported command injection flaw in Tenda AC10 firmware v15.03.06.26. If an exposed or reachable device is vulnerable, an attacker may be able to make the router execute unintended system commands. The public data does not provide CVSS scoring, official affected-product metadata, or a confirmed vendor fix.
Executive priority
Prioritize assessment if Tenda AC10 routers are present in business networks or remote sites. The issue is potentially serious because command injection can affect device integrity, but urgency is constrained by incomplete public severity, exposure, and fix information.
Technical view
The CVE description identifies command injection through the mac parameter in the formWriteFacMac function on Tenda AC10 v15.03.06.26. The record has no CVSS vector, CWE entry, CPE mapping, or named official remediation in the provided sources. KEV status is false, so active exploitation is not established here.
Likely exposure
Exposure is limited to environments using Tenda AC10 devices running firmware v15.03.06.26, especially where management functions are reachable from untrusted networks. The source bundle does not confirm other models, versions, authentication requirements, or default exposure.
Exploitation context
A public GitHub reference exists, but the provided bundle does not establish active exploitation, malware use, or inclusion in CISA KEV. Treat public technical detail as a research signal, not proof of widespread exploitation.
Researcher notes
Key gaps are authentication requirements, attack preconditions, reachable interface details, CVSS, vendor advisory status, and patch availability. Avoid generalizing beyond Tenda AC10 v15.03.06.26 unless additional vendor or CVE evidence supports it.
Mitigation direction
- Inventory Tenda AC10 devices and confirm firmware version v15.03.06.26.
- Check Tenda support or advisories for official firmware guidance.
- Remove router management interfaces from internet exposure where possible.
- Restrict administrative access to trusted networks and administrators.
- Consider isolation or replacement if no supported remediation is available.
Validation and detection
- Match device model and firmware version against the CVE description.
- Review whether management functions are reachable from untrusted networks.
- Check configuration and administration logs for unexpected changes.
- Confirm remediation status against official vendor guidance before closure.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
Execution behavior lookup
The CVE wording references code or command execution, so execution technique review may help defensive triage. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2023-37144 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.