CVE-2022-24150
📋 TL;DR
This vulnerability allows remote attackers to execute arbitrary commands on Tenda AX3 routers via command injection in the remoteIp parameter. Attackers can gain full control of affected devices, potentially compromising network security. Users running Tenda AX3 v16.03.12.10_CN firmware are affected.
💻 Affected Systems
- Tenda AX3
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete device takeover allowing attackers to install persistent malware, intercept all network traffic, pivot to internal networks, and use the device as part of a botnet.
Likely Case
Attackers gain remote shell access to modify router settings, intercept credentials, and deploy cryptocurrency miners or other malware.
If Mitigated
If properly segmented and monitored, impact limited to isolated network segment with no critical assets.
🎯 Exploit Status
Public proof-of-concept exists in GitHub repository. Exploitation requires sending crafted HTTP request to vulnerable endpoint.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check Tenda website for latest firmware
Vendor Advisory: Not publicly documented by vendor
Restart Required: Yes
Instructions:
1. Visit Tenda support website. 2. Download latest firmware for AX3. 3. Log into router admin interface. 4. Navigate to System Tools > Firmware Upgrade. 5. Upload and install new firmware. 6. Reboot router.
🔧 Temporary Workarounds
Disable Remote Management
allPrevent external access to router management interface
Network Segmentation
allIsolate router management interface to trusted network segment only
🧯 If You Can't Patch
- Replace affected router with different model or vendor
- Implement strict firewall rules blocking all external access to router management ports (typically 80, 443, 8080)
🔍 How to Verify
Check if Vulnerable:
Check router firmware version in admin interface under System Status or System ToolsCheck Version:
curl -s http://router-ip/goform/getStatus | grep versionVerify Fix Applied:
Verify firmware version is newer than v16.03.12.10_CN after update📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to /goform/setSafeWanWebMan
- Command execution patterns in system logs
- Unexpected process creation
Network Indicators:
- HTTP requests with shell metacharacters in parameters
- Outbound connections from router to suspicious IPs
SIEM Query:
source="router.log" AND (url="/goform/setSafeWanWebMan" OR (param="remoteIp" AND value MATCHES "[;&|`$()]"))