CVE-2022-37810

Deeper analysis

Tenda AC1206 firmware version V15.03.06.23 contains a command injection vulnerability in the formWriteFacMac function, where the mac parameter is processed without adequate sanitization. The flaw is tracked as CWE-78 and carries a CVSS 3.1 score of 9.8, reflecting network-accessible exploitation without authentication or user interaction.

An unauthenticated attacker can supply a crafted mac value over the network to the affected endpoint, resulting in arbitrary operating-system command execution. Successful exploitation grants the attacker full control over the device, including the ability to read or modify configuration data, install persistent malware, or pivot to adjacent network resources.

Public references consist of proof-of-concept repositories demonstrating the injection vector; no vendor advisory or firmware patch information is included in the available sources. The associated EPSS score has reached a peak of 0.1836, indicating moderate and sustained exploitation interest following disclosure.