CVE-2022-24162
📋 TL;DR
CVE-2022-24162 is a stack overflow vulnerability in Tenda AX3 routers running firmware version 16.03.12.10_CN. Attackers can exploit this by sending specially crafted requests to the saveParentControlInfo function, causing a Denial of Service (DoS) that crashes the device. This affects users of Tenda AX3 routers with the vulnerable firmware version.
💻 Affected Systems
- Tenda AX3
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete router crash requiring physical power cycle, potentially allowing persistent DoS attacks that render the device unusable until manually reset.
Likely Case
Temporary service disruption where the router reboots automatically or requires manual restart, interrupting network connectivity for connected devices.
If Mitigated
Minimal impact if the router has automatic recovery mechanisms or if network redundancy exists.
🎯 Exploit Status
Proof of concept code is publicly available in GitHub repositories. The vulnerability requires sending crafted HTTP requests to the vulnerable endpoint.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Later firmware versions from Tenda
Vendor Advisory: Not publicly documented by Tenda
Restart Required: Yes
Instructions:
1. Log into Tenda AX3 router admin interface. 2. Navigate to System Tools > Firmware Upgrade. 3. Check for and install the latest firmware version. 4. Reboot the router after installation.
🔧 Temporary Workarounds
Disable Parental Control Feature
allDisable the parental control functionality that contains the vulnerable saveParentControlInfo function
Network Segmentation
allPlace the router behind a firewall that restricts access to its administrative interface
🧯 If You Can't Patch
- Implement network access controls to restrict who can access the router's administrative interface
- Monitor router logs for unusual reboot patterns or failed authentication attempts to the parental control feature
🔍 How to Verify
Check if Vulnerable:
Check router firmware version in admin interface. If version is exactly 16.03.12.10_CN, the device is vulnerable.Check Version:
Connect to router admin interface and navigate to System Status or System Tools sectionVerify Fix Applied:
After updating firmware, verify the version number has changed from 16.03.12.10_CN to a newer version.📡 Detection & Monitoring
Log Indicators:
- Multiple failed requests to parental control endpoints
- Unexpected router reboots
- HTTP requests with malformed time parameters
Network Indicators:
- Unusual HTTP POST requests to router's parental control API endpoints
- Traffic patterns indicating DoS attempts against router
SIEM Query:
source="router_logs" AND (uri="*/goform/saveParentControlInfo" OR message="*parental*control*" OR event="router_reboot")