CVE-2022-45497
Published: 08 December 2022
Summary
CVE-2022-45497 is a critical-severity OS Command Injection (CWE-78) vulnerability in Tenda W6-S Firmware. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 4.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
Tenda W6-S v1.0.0.4(510) contains an OS command injection vulnerability (CWE-78) in the tpi_get_ping_output function reachable at the /goform/exeCommand endpoint. The flaw is rated 9.8 under CVSS 3.1, reflecting network attack vector, low complexity, and no required credentials or user interaction.
An unauthenticated remote attacker can supply crafted input to the endpoint and execute arbitrary operating-system commands on the device, resulting in complete control over confidentiality, integrity, and availability of the affected router.
Public proof-of-concept code demonstrating the injection has been published on GitHub. No vendor advisory or firmware patch information appears in the supplied references. The CVE’s EPSS score currently stands at 0.1786 with a recorded peak of 0.1836; the modest difference does not indicate a pronounced post-disclosure climb from a low baseline.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-48363
Vulnerability details
Tenda W6-S v1.0.0.4(510) was discovered to contain a command injection vulnerability in the tpi_get_ping_output function at /goform/exeCommand.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.