CVE-2022-45980
Published: 12 December 2022
Summary
CVE-2022-45980 is a high-severity CSRF (CWE-352) vulnerability in Tenda Ax12 Firmware. Its CVSS base score is 8.8 (High).
Operationally, ranked in the top 19.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
Tenda AX12 firmware version V22.03.01.21_CN contains a cross-site request forgery vulnerability at the /goform/SysToolRestoreSet endpoint, tracked as CVE-2022-45980 with a CVSS 3.1 score of 8.8. The flaw is classified under CWE-352 and affects the web management interface of this wireless router model.
An unauthenticated remote attacker can exploit the issue by crafting a malicious web page or link that, when visited by an authenticated administrator, causes the device to execute unauthorized restore operations. Successful exploitation can result in full compromise of confidentiality, integrity, and availability on the affected router without requiring any privileges beyond tricking the user into interaction.
The associated EPSS score rose from a low baseline to a peak of 0.0923 on 2025-12-11 before receding to the current value of 0.0139, indicating a period of increased exploitation interest after public disclosure. Public references consist of proof-of-concept repositories demonstrating the CSRF vector but contain no vendor advisory or patch details.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-48819
Vulnerability details
Tenda AX12 V22.03.01.21_CN was discovered to contain a Cross-Site Request Forgery (CSRF) via /goform/SysToolRestoreSet .
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Awareness training educates users on avoiding untrusted links and actions that can be exploited via CSRF.
Requiring user re-entry of credentials for sensitive actions prevents automated forgery of requests without active user participation.
Security testing regimens explicitly include checks for missing or ineffective anti-CSRF protections in web applications.
Detects anomalous request patterns consistent with cross-site request forgery.