CVE-2022-24165
Published: 04 February 2022
Summary
CVE-2022-24165 is a critical-severity Command Injection (CWE-77) vulnerability in Tendacn G1 Firmware. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 5.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
Tenda routers G1 and G3 running firmware version v15.11.0.17(9502)_CN contain a command injection vulnerability in the formSetQvlanList function. The flaw, identified as CVE-2022-24165 and assigned CWE-77, arises from insufficient sanitization of the qvlanIP parameter and carries a CVSS 3.1 score of 9.8 reflecting network-accessible exploitation with no required credentials or user interaction.
An unauthenticated attacker can supply a malicious qvlanIP value to the affected endpoint and execute arbitrary operating-system commands on the device, resulting in complete control over configuration, traffic, and stored data.
The listed references consist of a GitHub repository that reproduces the issue but contain no vendor advisory, patch information, or mitigation guidance.
The associated EPSS score has remained flat at 0.1555 with no material rise after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-29076
Vulnerability details
Tenda routers G1 and G3 v15.11.0.17(9502)_CN were discovered to contain a command injection vulnerability in the function formSetQvlanList. This vulnerability allows attackers to execute arbitrary commands via the qvlanIP parameter.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.