CVE-2022-24148

Deeper analysis

Tenda AX3 firmware version 16.03.12.10_CN contains a command-injection flaw in the mDMZSetCfg function. The vulnerability is triggered when an attacker supplies a crafted dmzIp parameter, allowing arbitrary operating-system commands to be executed on the device. The issue is tracked as CVE-2022-24148 and carries a CVSS 3.1 base score of 9.8.

Because the affected endpoint is reachable over the network without authentication, any remote attacker can exploit the flaw to obtain full control of the router. Successful exploitation grants the ability to read or modify configuration data, install persistent malware, or use the device as an entry point into the attached network.

Public references consist of a technical write-up that demonstrates the injection vector but contain no vendor advisory, firmware update, or mitigation guidance. The associated EPSS score has remained flat at 0.0914 since disclosure, indicating no measurable increase in observed exploitation activity.