Tenda AC500 V2.0.1.9(1307) firmware contains a command injection vulnerablility in the formexeCommand function via the cmdinput parameter.
CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')