Cyber Resilience

CVE-2022-45497

CriticalPublic PoCRCE

Published: 08 December 2022

Published
08 December 2022
Modified
23 April 2025
KEV Added
Patch
CVSS Score v3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.1786 95.3th percentile
Risk Priority 30 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2022-45497 is a critical-severity OS Command Injection (CWE-78) vulnerability in Tenda W6-S Firmware. Its CVSS base score is 9.8 (Critical).

Operationally, ranked in the top 4.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

Deeper analysis

Tenda W6-S v1.0.0.4(510) contains an OS command injection vulnerability (CWE-78) in the tpi_get_ping_output function reachable at the /goform/exeCommand endpoint. The flaw is rated 9.8 under CVSS 3.1, reflecting network attack vector, low complexity, and no required credentials or user interaction.

An unauthenticated remote attacker can supply crafted input to the endpoint and execute arbitrary operating-system commands on the device, resulting in complete control over confidentiality, integrity, and availability of the affected router.

Public proof-of-concept code demonstrating the injection has been published on GitHub. No vendor advisory or firmware patch information appears in the supplied references. The CVE’s EPSS score currently stands at 0.1786 with a recorded peak of 0.1836; the modest difference does not indicate a pronounced post-disclosure climb from a low baseline.

EU & UK References

Vulnerability details

Tenda W6-S v1.0.0.4(510) was discovered to contain a command injection vulnerability in the tpi_get_ping_output function at /goform/exeCommand.

CWE(s)

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

tenda
w6-s firmware
1.0.0.4\(510\)

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-78

Platform-independent apps typically execute inside a managed runtime or sandbox that restricts direct OS command execution, reducing the ability to exploit OS command injection.

addresses: CWE-78

Validates inputs to block special elements that would alter OS command execution.

References