Cyber Resilience

CVE-2022-45043

HighPublic PoCRCE

Published: 12 December 2022

Published
12 December 2022
Modified
22 April 2025
KEV Added
Patch
CVSS Score v3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.1749 95.2th percentile
Risk Priority 28 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2022-45043 is a high-severity OS Command Injection (CWE-78) vulnerability in Tenda Ax12 Firmware. Its CVSS base score is 8.8 (High).

Operationally, ranked in the top 4.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

Deeper analysis

Tenda AX12 firmware version V22.03.01.16_cn contains a command-injection vulnerability (CWE-78) reachable via the goform/fast_setting_internet_set endpoint. The flaw carries a CVSS 3.1 score of 8.8, reflecting network-accessible exploitation that requires only low-privilege credentials and no user interaction.

An authenticated attacker who can reach the web interface can supply crafted parameters that result in arbitrary command execution on the device, granting the ability to read, modify, or disrupt configuration and data with high impact to confidentiality, integrity, and availability.

Public proof-of-concept code demonstrating the issue has been published on GitHub, and the EPSS score has remained near 0.18 since disclosure without a pronounced upward trajectory. No vendor advisory or patch information is referenced in the supplied sources.

EU & UK References

Vulnerability details

Tenda AX12 V22.03.01.16_cn is vulnerable to command injection via goform/fast_setting_internet_set.

CWE(s)

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

tenda
ax12 firmware
22.03.01.16_cn

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-78

Platform-independent apps typically execute inside a managed runtime or sandbox that restricts direct OS command execution, reducing the ability to exploit OS command injection.

addresses: CWE-78

Validates inputs to block special elements that would alter OS command execution.

References