CVE-2022-24170
Published: 04 February 2022
Summary
CVE-2022-24170 is a critical-severity Command Injection (CWE-77) vulnerability in Tendacn G1 Firmware. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 5.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
Tenda routers G1 and G3 running firmware version v15.11.0.17(9502)_CN contain a command injection vulnerability in the formSetIpSecTunnel function. The flaw, tracked as CVE-2022-24170 and assigned CWE-77, permits arbitrary command execution through unsanitized input in the IPsecLocalNet and IPsecRemoteNet parameters. It carries a CVSS 3.1 base score of 9.8, reflecting network-accessible exploitation without authentication or user interaction.
An unauthenticated attacker can supply malicious values to the affected parameters over the network and achieve arbitrary command execution on the device, potentially leading to full compromise of the router's confidentiality, integrity, and availability. The vulnerability was publicly detailed in technical reports hosted on GitHub that include proof-of-concept details for the affected Tenda models.
The associated EPSS score has remained flat at 0.1555 with no material increase since disclosure, indicating limited observed exploitation interest to date. No vendor advisory or firmware patch information is referenced in the available sources.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-29081
Vulnerability details
Tenda routers G1 and G3 v15.11.0.17(9502)_CN were discovered to contain a command injection vulnerability in the function formSetIpSecTunnel. This vulnerability allows attackers to execute arbitrary commands via the IPsecLocalNet and IPsecRemoteNet parameters.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.