CVE-2022-24171
Published: 04 February 2022
Summary
CVE-2022-24171 is a critical-severity Command Injection (CWE-77) vulnerability in Tendacn G1 Firmware. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 5.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
Tenda routers G1 and G3 running firmware version v15.11.0.17(9502)_CN contain a command injection vulnerability in the formSetPppoeServer function. The flaw, identified as CVE-2022-24171 and assigned CWE-77, arises from insufficient input validation on the pppoeServerIP, pppoeServerStartIP, and pppoeServerEndIP parameters, allowing unsanitized values to reach system command execution paths.
Unauthenticated attackers with network access can exploit the issue without user interaction to execute arbitrary commands on the device. Successful exploitation grants full control over the router, resulting in complete compromise of confidentiality, integrity, and availability consistent with the CVSS 9.8 rating.
Public references consist of technical write-ups that demonstrate the injection vectors, but no vendor advisories or firmware patches are referenced. The associated EPSS score has remained flat at 0.1555 with no material rise since publication.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-29082
Vulnerability details
Tenda routers G1 and G3 v15.11.0.17(9502)_CN were discovered to contain a command injection vulnerability in the function formSetPppoeServer. This vulnerability allows attackers to execute arbitrary commands via the pppoeServerIP, pppoeServerStartIP, and pppoeServerEndIP parameters.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.