CVE-2022-45043
Published: 12 December 2022
Summary
CVE-2022-45043 is a high-severity OS Command Injection (CWE-78) vulnerability in Tenda Ax12 Firmware. Its CVSS base score is 8.8 (High).
Operationally, ranked in the top 4.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
Tenda AX12 firmware version V22.03.01.16_cn contains a command-injection vulnerability (CWE-78) reachable via the goform/fast_setting_internet_set endpoint. The flaw carries a CVSS 3.1 score of 8.8, reflecting network-accessible exploitation that requires only low-privilege credentials and no user interaction.
An authenticated attacker who can reach the web interface can supply crafted parameters that result in arbitrary command execution on the device, granting the ability to read, modify, or disrupt configuration and data with high impact to confidentiality, integrity, and availability.
Public proof-of-concept code demonstrating the issue has been published on GitHub, and the EPSS score has remained near 0.18 since disclosure without a pronounced upward trajectory. No vendor advisory or patch information is referenced in the supplied sources.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-47968
Vulnerability details
Tenda AX12 V22.03.01.16_cn is vulnerable to command injection via goform/fast_setting_internet_set.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.