CVE-2022-45996
Published: 12 December 2022
Summary
CVE-2022-45996 is a high-severity OS Command Injection (CWE-78) vulnerability in Tenda W20E Firmware. Its CVSS base score is 7.2 (High).
Operationally, ranked in the top 11.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
Tenda W20E firmware version V16.01.0.6(3392) contains an OS command injection vulnerability (CWE-78) in the cmd_get_ping_output function. The flaw carries a CVSS 3.1 score of 7.2 and permits an authenticated administrator to supply crafted input that is executed directly by the underlying operating system.
An attacker with network access and valid high-privileged credentials can exploit the issue to execute arbitrary commands on the device. Successful exploitation yields full control over confidentiality, integrity, and availability of the router, allowing actions such as configuration changes, traffic interception, or persistence mechanisms.
Public references consist of GitHub repositories that document the injection vector and provide proof-of-concept details, but no vendor advisory or official patch information is included in the supplied sources.
EPSS for the CVE rose from a low baseline to a peak of 0.1148 before receding to the current value of 0.0372, indicating a measurable increase in exploitation interest after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-48834
Vulnerability details
Tenda W20E V16.01.0.6(3392) is vulnerable to Command injection via cmd_get_ping_output.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.