CVE-2022-24152
📋 TL;DR
CVE-2022-24152 is a stack overflow vulnerability in Tenda AX3 routers running firmware version 16.03.12.10_CN. Attackers can exploit this by sending specially crafted requests to the fromSetRouteStatic function, causing a denial of service that crashes the router. This affects users of Tenda AX3 routers with the vulnerable Chinese firmware version.
💻 Affected Systems
- Tenda AX3
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete router crash requiring physical reboot, potential remote code execution if stack overflow can be controlled to execute arbitrary code (though not confirmed in this CVE).
Likely Case
Router becomes unresponsive and requires reboot, disrupting network connectivity for all connected devices.
If Mitigated
Limited impact if router is behind firewall with restricted WAN access, though LAN exploitation remains possible.
🎯 Exploit Status
Exploit requires authentication to the router's web interface. The GitHub reference contains proof-of-concept code showing how to trigger the overflow via the list parameter.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check Tenda website for firmware updates beyond v16.03.12.10_CN
Vendor Advisory: Not publicly documented by Tenda
Restart Required: Yes
Instructions:
1. Log into Tenda router web interface. 2. Navigate to System Tools > Firmware Upgrade. 3. Download latest firmware from Tenda website. 4. Upload and install firmware update. 5. Router will reboot automatically.
🔧 Temporary Workarounds
Disable Remote Management
allPrevent external access to router web interface
Change Default Credentials
allUse strong unique password to make authentication harder
🧯 If You Can't Patch
- Isolate router on separate VLAN with strict access controls
- Implement network monitoring for abnormal requests to router management interface
🔍 How to Verify
Check if Vulnerable:
Check router firmware version in web interface: System Status > Firmware Version. If version is exactly 16.03.12.10_CN, you are vulnerable.Check Version:
No CLI command - check via web interface at 192.168.0.1 or router IPVerify Fix Applied:
After firmware update, verify version has changed from 16.03.12.10_CN to a newer version.📡 Detection & Monitoring
Log Indicators:
- Router crash/reboot logs
- Multiple failed authentication attempts followed by large POST requests to fromSetRouteStatic
Network Indicators:
- Unusual HTTP POST requests to router management interface with large list parameter values
SIEM Query:
source="router_logs" AND (event="crash" OR event="reboot") OR http_method="POST" AND uri="*/fromSetRouteStatic" AND content_length>1000