CVE-2022-24143
📋 TL;DR
This CVE describes a stack overflow vulnerability in Tenda AX3 and AX12 routers' form_fast_setting_wifi_set function. Attackers can exploit it by sending specially crafted timeZone parameter values to cause a Denial of Service (DoS), potentially crashing the router. Users of affected Tenda router models with vulnerable firmware versions are impacted.
💻 Affected Systems
- Tenda AX3
- Tenda AX12
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Router becomes completely unresponsive, requiring physical power cycle or factory reset to restore functionality, disrupting all network services.
Likely Case
Router crashes or becomes unstable, causing temporary network outage until device reboots automatically or manually.
If Mitigated
If network segmentation and access controls are implemented, impact is limited to the router itself without affecting other network segments.
🎯 Exploit Status
Public proof-of-concept exists in GitHub repository. Exploitation requires network access to router's web interface.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check Tenda website for latest firmware updates
Vendor Advisory: https://www.tendacn.com/en/
Restart Required: Yes
Instructions:
1. Log into router admin interface. 2. Navigate to System Tools > Firmware Upgrade. 3. Download latest firmware from Tenda website. 4. Upload and install firmware. 5. Router will reboot automatically.
🔧 Temporary Workarounds
Disable remote management
allPrevent external access to router web interface
Network segmentation
allIsolate router management interface to trusted network segment
🧯 If You Can't Patch
- Replace affected routers with patched or different models
- Implement strict firewall rules to block all external access to router management interface
🔍 How to Verify
Check if Vulnerable:
Check router firmware version in admin interface under System Status or Firmware VersionCheck Version:
Login to router web interface and check System Status pageVerify Fix Applied:
Verify firmware version has been updated to newer than affected versions📡 Detection & Monitoring
Log Indicators:
- Router crash/reboot logs
- Unusual HTTP POST requests to form_fast_setting_wifi_set endpoint
Network Indicators:
- Sudden loss of connectivity to router
- Unusual traffic patterns to router management interface
SIEM Query:
source="router_logs" AND ("crash" OR "reboot" OR "form_fast_setting_wifi_set")