CVE-2022-45977
Published: 12 December 2022
Summary
CVE-2022-45977 is a high-severity OS Command Injection (CWE-78) vulnerability in Tenda Ax12 Firmware. Its CVSS base score is 8.8 (High).
Operationally, ranked in the top 8.9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
Tenda AX12 routers running firmware version V22.03.01.21_CN contain a command-injection flaw (CWE-78) in the /goform/setMacFilterCfg function. The vulnerability received a CVSS 3.1 score of 8.8, reflecting network-accessible exploitation that requires only low-privileged credentials and no user interaction.
An authenticated attacker can supply crafted parameters to the affected endpoint, causing the device to execute attacker-controlled operating-system commands. Successful exploitation grants the ability to read, modify, or delete arbitrary data and to alter device configuration, resulting in full compromise of the router's confidentiality, integrity, and availability.
Public references consist of proof-of-concept material hosted in GitHub repositories that demonstrate the injection vector. The EPSS score rose from lower values to a peak of 0.1798 before receding to its current level of 0.0622, indicating a period of increased exploitation interest after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-48816
Vulnerability details
Tenda AX12 V22.03.01.21_CN was found to have a command injection vulnerability via /goform/setMacFilterCfg function.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.