Cyber Resilience

CVE-2022-24165

CriticalPublic PoCRCE

Published: 04 February 2022

Published
04 February 2022
Modified
21 November 2024
KEV Added
Patch
CVSS Score v3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.1555 94.8th percentile
Risk Priority 29 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2022-24165 is a critical-severity Command Injection (CWE-77) vulnerability in Tendacn G1 Firmware. Its CVSS base score is 9.8 (Critical).

Operationally, ranked in the top 5.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

Deeper analysis

Tenda routers G1 and G3 running firmware version v15.11.0.17(9502)_CN contain a command injection vulnerability in the formSetQvlanList function. The flaw, identified as CVE-2022-24165 and assigned CWE-77, arises from insufficient sanitization of the qvlanIP parameter and carries a CVSS 3.1 score of 9.8 reflecting network-accessible exploitation with no required credentials or user interaction.

An unauthenticated attacker can supply a malicious qvlanIP value to the affected endpoint and execute arbitrary operating-system commands on the device, resulting in complete control over configuration, traffic, and stored data.

The listed references consist of a GitHub repository that reproduces the issue but contain no vendor advisory, patch information, or mitigation guidance.

The associated EPSS score has remained flat at 0.1555 with no material rise after disclosure.

EU & UK References

Vulnerability details

Tenda routers G1 and G3 v15.11.0.17(9502)_CN were discovered to contain a command injection vulnerability in the function formSetQvlanList. This vulnerability allows attackers to execute arbitrary commands via the qvlanIP parameter.

CWE(s)

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

tendacn
g1 firmware
15.11.0.17\(9502\)_cn
tendacn
g3 firmware
15.11.0.17\(9502\)_cn

Mitigating Controls

No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.

References