CVE-2022-24170
📋 TL;DR
This CVE describes a command injection vulnerability in Tenda G1 and G3 routers that allows attackers to execute arbitrary commands via specific parameters. Attackers can potentially take full control of affected routers. Users of Tenda G1 and G3 routers with vulnerable firmware versions are affected.
💻 Affected Systems
- Tenda G1 router
- Tenda G3 router
📦 What is this software?
G1 Firmware by Tendacn
G3 Firmware by Tendacn
⚠️ Risk & Real-World Impact
Worst Case
Complete router compromise allowing attackers to intercept all network traffic, install persistent backdoors, pivot to internal networks, and use the router for botnet activities.
Likely Case
Router takeover leading to DNS hijacking, credential theft from network traffic, and installation of malware on connected devices.
If Mitigated
Limited impact if routers are behind firewalls with strict inbound filtering and network segmentation prevents lateral movement.
🎯 Exploit Status
Public proof-of-concept code exists in GitHub repositories. The vulnerability requires no authentication and has simple exploitation vectors.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check Tenda support for latest firmware
Vendor Advisory: No official vendor advisory URL found
Restart Required: Yes
Instructions:
1. Log into router admin interface. 2. Navigate to firmware update section. 3. Download latest firmware from Tenda website. 4. Upload and install firmware update. 5. Reboot router after installation.
🔧 Temporary Workarounds
Disable IPsec functionality
allDisable IPsec VPN functionality if not required, as the vulnerability exists in the IPsec configuration handler.
Network segmentation
allPlace routers in isolated network segments with strict firewall rules limiting access to management interfaces.
🧯 If You Can't Patch
- Replace affected routers with different models or brands
- Implement strict network access controls to limit exposure to router management interfaces
🔍 How to Verify
Check if Vulnerable:
Check router firmware version in admin interface. If version is v15.11.0.17(9502)_CN, the device is vulnerable.Check Version:
Log into router web interface and check System Status or Firmware Update section for current version.Verify Fix Applied:
After updating firmware, verify the version has changed from v15.11.0.17(9502)_CN to a newer version.📡 Detection & Monitoring
Log Indicators:
- Unusual command execution in router logs
- Unexpected IPsec configuration changes
- Failed authentication attempts to router admin interface
Network Indicators:
- Unusual outbound connections from router
- DNS queries to suspicious domains from router
- Unexpected VPN tunnel establishment
SIEM Query:
source="router_logs" AND ("formSetIpSecTunnel" OR "IPsecLocalNet" OR "IPsecRemoteNet")