An issue was discovered in goform/formSetIptv in Tenda AC15V1.0 V15.03.05.18_multi. When the condition is met, s1_1 will be passed into sub_B0488, concatenated into doSystemCmd. The value of s1_1 is not validated, potentially leading to a command injection vulnerability.