CVE-2022-24156
📋 TL;DR
CVE-2022-24156 is a stack overflow vulnerability in Tenda AX3 routers running firmware version 16.03.12.10_CN. Attackers can exploit this by sending specially crafted requests to the formSetVirtualSer function, causing a Denial of Service (DoS) that crashes the device. This affects users of Tenda AX3 routers with the vulnerable firmware version.
💻 Affected Systems
- Tenda AX3
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete router crash requiring physical reboot, potentially disrupting all network connectivity for connected devices.
Likely Case
Router becomes unresponsive, requiring manual reboot to restore functionality.
If Mitigated
If properly segmented and firewalled, impact limited to router management interface only.
🎯 Exploit Status
Public proof-of-concept available in GitHub repository. Exploitation requires network access to router management interface.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Later versions than v16.03.12.10_CN
Vendor Advisory: Not publicly documented
Restart Required: Yes
Instructions:
1. Log into Tenda router admin interface. 2. Navigate to firmware update section. 3. Download latest firmware from Tenda website. 4. Upload and apply firmware update. 5. Reboot router after update completes.
🔧 Temporary Workarounds
Disable remote management
allPrevent external access to router management interface
Network segmentation
allIsolate router management interface to trusted network only
🧯 If You Can't Patch
- Disable WAN access to router management interface
- Implement network firewall rules to block access to router management ports from untrusted networks
🔍 How to Verify
Check if Vulnerable:
Check router firmware version in admin interface. If version is exactly 16.03.12.10_CN, device is vulnerable.Check Version:
Check via router web interface or SSH if enabled: cat /proc/version or similar router-specific commandsVerify Fix Applied:
Verify firmware version has been updated to a version later than 16.03.12.10_CN.📡 Detection & Monitoring
Log Indicators:
- Router crash/reboot logs
- Multiple failed connection attempts to management interface
- Unusual traffic patterns to router management ports
Network Indicators:
- HTTP POST requests to formSetVirtualSer endpoint with malformed list parameter
- Sudden loss of router connectivity
SIEM Query:
source_ip="*" AND dest_port="80" OR dest_port="443" AND http_uri="*/goform/SetVirtualSer" AND http_method="POST"