CVE-2022-27081
Published: 24 March 2022
Summary
CVE-2022-27081 is a critical-severity Command Injection (CWE-77) vulnerability in Tenda M3 Firmware. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 5.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
Tenda M3 firmware version 1.10 V1.0.0.12(4856) contains a command injection vulnerability in the /goform/SetLanInfo endpoint. The flaw is tracked as CVE-2022-27081 with a CVSS 3.1 base score of 9.8 and is classified under CWE-77. The affected component processes LAN configuration input without adequate sanitization, allowing arbitrary command execution on the device.
An unauthenticated attacker with network access can supply crafted parameters to the endpoint and execute operating-system commands. Successful exploitation grants full control over the device, including the ability to read, modify, or delete data and disrupt device operation.
Public references consist of a detailed proof-of-concept hosted on GitHub that demonstrates the injection vector; no vendor advisory or firmware update addressing the issue is referenced in the available sources. The EPSS score reached a peak of 0.1908 after disclosure before settling at the current value of 0.1285, indicating measurable post-publication exploitation interest.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-31621
Vulnerability details
Tenda M3 1.10 V1.0.0.12(4856) was discovered to contain a command injection vulnerability via the component /goform/SetLanInfo.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.