Tenda AC7V1.0 v15.03.06.44 firmware contains a command injection vulnerablility in formexeCommand function via the cmdinput parameter.
CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')