CVE-2022-24146
📋 TL;DR
Tenda AX3 routers running firmware version 16.03.12.10_CN contain a stack overflow vulnerability in the formSetQosBand function. Attackers can exploit this by sending specially crafted requests to the list parameter, causing a Denial of Service (DoS) that crashes the router. This affects users of Tenda AX3 routers with the vulnerable firmware version.
💻 Affected Systems
- Tenda AX3
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete router crash requiring physical power cycle, potentially leading to extended network downtime and loss of connectivity for all connected devices.
Likely Case
Router becomes unresponsive, requiring reboot to restore functionality, causing temporary network disruption.
If Mitigated
If router is behind firewall with restricted WAN access, impact is limited to internal attackers only.
🎯 Exploit Status
Public proof-of-concept available in GitHub repository; exploitation requires sending crafted HTTP request to vulnerable endpoint.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Not available
Restart Required: Yes
Instructions:
1. Check Tenda official website for firmware updates
2. If update available, download and upload via router admin interface
3. Reboot router after update
🔧 Temporary Workarounds
Disable QoS Bandwidth Control
allDisable the QoS feature that contains the vulnerable function
Restrict Router Admin Access
allLimit access to router admin interface to trusted IP addresses only
🧯 If You Can't Patch
- Replace router with different model or vendor
- Place router behind firewall with strict inbound rules
🔍 How to Verify
Check if Vulnerable:
Check router firmware version in admin interface under System Status or About pageCheck Version:
Not applicable - check via router web interfaceVerify Fix Applied:
Verify firmware version is newer than v16.03.12.10_CN📡 Detection & Monitoring
Log Indicators:
- Router crash logs
- Repeated reboot events
- Unusual HTTP requests to formSetQosBand endpoint
Network Indicators:
- Sudden loss of router connectivity
- Unusual HTTP traffic to router admin port
SIEM Query:
Not applicable - router logs typically not integrated into SIEM