CVE-2022-24144
📋 TL;DR
CVE-2022-24144 is a critical command injection vulnerability in Tenda AX3 routers that allows attackers to execute arbitrary system commands by manipulating gateway, dns1, and dns2 parameters. This affects Tenda AX3 v16.03.12.10_CN routers, potentially giving attackers full control over vulnerable devices. Attackers can exploit this remotely without authentication.
💻 Affected Systems
- Tenda AX3
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of router with persistent backdoor installation, credential theft, network pivoting to internal systems, and participation in botnets.
Likely Case
Router takeover for DNS hijacking, credential harvesting, and use as proxy for malicious traffic.
If Mitigated
Limited impact if router is behind firewall with restricted WAN access and strong network segmentation.
🎯 Exploit Status
Public GitHub repository contains proof-of-concept. Exploitation requires sending crafted HTTP requests to vulnerable endpoint.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Later versions than v16.03.12.10_CN
Vendor Advisory: Not publicly documented by Tenda
Restart Required: Yes
Instructions:
1. Log into router admin interface. 2. Navigate to firmware update section. 3. Download latest firmware from Tenda website. 4. Upload and apply update. 5. Reboot router.
🔧 Temporary Workarounds
Disable WAN Management Access
allPrevent external access to router management interface
Login to router → Advanced Settings → Remote Management → Disable
Network Segmentation
allIsolate router management interface to separate VLAN
🧯 If You Can't Patch
- Replace vulnerable router with patched model or different vendor
- Implement strict firewall rules blocking all external access to router management ports (typically 80, 443, 8080)
🔍 How to Verify
Check if Vulnerable:
Check router firmware version in admin interface. If version is v16.03.12.10_CN, device is vulnerable.Check Version:
curl -s http://router-ip/ | grep -i version or check web interfaceVerify Fix Applied:
Verify firmware version is updated to later version than v16.03.12.10_CN📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to /goform/WanParameterSetting
- Suspicious commands in system logs
- Unexpected process execution
Network Indicators:
- Unusual outbound connections from router
- DNS traffic to malicious servers
- Unexpected port openings
SIEM Query:
source="router_logs" AND (uri="/goform/WanParameterSetting" OR cmd="*;*" OR cmd="*|*")