CVE-2022-24144
Published: 04 February 2022
Summary
CVE-2022-24144 is a critical-severity Command Injection (CWE-77) vulnerability in Tenda Ax3 Firmware. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 6.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
Tenda AX3 firmware version 16.03.12.10_CN contains a command injection vulnerability in the WanParameterSetting function, tracked as CVE-2022-24144 and assigned CWE-77. The flaw permits arbitrary command execution when attacker-controlled values are supplied to the gateway, dns1, and dns2 parameters. It carries a CVSS 3.1 base score of 9.8 reflecting a network-accessible attack with no required credentials or user interaction.
An unauthenticated remote attacker can send crafted HTTP requests to the affected router and execute operating-system commands with the privileges of the web server process, resulting in full device compromise including configuration changes, traffic interception, or persistence.
The two provided references consist of GitHub repositories that demonstrate the issue but contain no vendor advisory, patch information, or mitigation guidance. The associated EPSS score has remained in a narrow band near 0.11 with a recorded peak of 0.127, indicating moderate but stable exploitation interest since disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-29055
Vulnerability details
Tenda AX3 v16.03.12.10_CN was discovered to contain a command injection vulnerability in the function WanParameterSetting. This vulnerability allows attackers to execute arbitrary commands via the gateway, dns1, and dns2 parameters.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.