CVE-2022-27080
Published: 24 March 2022
Summary
CVE-2022-27080 is a critical-severity Command Injection (CWE-77) vulnerability in Tenda M3 Firmware. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 5.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
Tenda M3 firmware version 1.10 V1.0.0.12(4856) contains a command injection vulnerability in the /goform/setWorkmode component. The flaw is tracked as CVE-2022-27080, carries a CVSS 3.1 score of 9.8, and is classified under CWE-77.
An unauthenticated attacker with network access can supply crafted input to the affected endpoint and execute arbitrary commands on the device. Successful exploitation grants full control over confidentiality, integrity, and availability of the router without requiring user interaction.
Public references consist of technical write-ups hosted on GitHub that demonstrate the injection vector but do not detail vendor patches or official mitigation steps.
EPSS scores for the CVE reached a peak of 0.1908 after disclosure before settling at the current value of 0.1285, indicating a measurable increase in observed exploitation interest following publication.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-31620
Vulnerability details
Tenda M3 1.10 V1.0.0.12(4856) was discovered to contain a command injection vulnerability via the component /goform/setWorkmode.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.