CVE-2022-25449
📋 TL;DR
This vulnerability allows remote attackers to execute arbitrary code on Tenda AC6 routers by exploiting a stack overflow in the saveParentControlInfo function. Attackers can send specially crafted requests containing malicious deviceId parameters to gain full control of affected devices. This affects all users running the vulnerable firmware version.
💻 Affected Systems
- Tenda AC6 wireless router
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete device compromise leading to persistent backdoor installation, network traffic interception, credential theft, and lateral movement to other network devices.
Likely Case
Remote code execution allowing attackers to modify router settings, intercept traffic, or use the device as part of a botnet.
If Mitigated
Limited impact if devices are behind firewalls with strict inbound filtering and network segmentation.
🎯 Exploit Status
Public proof-of-concept code exists in GitHub repositories. Exploitation requires sending a crafted HTTP request to the vulnerable endpoint.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Later versions than v15.03.05.09_multi
Vendor Advisory: Not publicly documented by vendor
Restart Required: Yes
Instructions:
1. Log into Tenda router admin interface. 2. Navigate to System Tools > Firmware Upgrade. 3. Download latest firmware from Tenda website. 4. Upload and install new firmware. 5. Reboot router after installation.
🔧 Temporary Workarounds
Disable remote management
allPrevent external access to router administration interface
Network segmentation
allIsolate router management interface to trusted network segment
🧯 If You Can't Patch
- Replace affected devices with patched or different model routers
- Implement strict network firewall rules blocking all inbound traffic to router management interfaces
🔍 How to Verify
Check if Vulnerable:
Check firmware version in router admin interface under System Status or System Tools > Firmware UpgradeCheck Version:
Not applicable - check via web interfaceVerify Fix Applied:
Confirm firmware version is newer than v15.03.05.09_multi after patching📡 Detection & Monitoring
Log Indicators:
- Unusual HTTP POST requests to saveParentControlInfo endpoint
- Multiple failed authentication attempts followed by successful exploitation
Network Indicators:
- Unusual outbound connections from router
- Traffic patterns suggesting command and control communication
SIEM Query:
source_ip="router_ip" AND (uri="*/goform/saveParentControlInfo" OR user_agent="*exploit*")