CVE-2022-25453
📋 TL;DR
This vulnerability allows remote attackers to execute arbitrary code on Tenda AC6 routers via a stack overflow in the saveParentControlInfo function. Attackers can exploit this by sending specially crafted requests to the vulnerable time parameter. All users running the affected firmware version are at risk.
💻 Affected Systems
- Tenda AC6 wireless router
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete device compromise leading to persistent backdoor installation, network traffic interception, and lateral movement to other devices on the network.
Likely Case
Remote code execution allowing attackers to modify router settings, intercept traffic, or use the device as part of a botnet.
If Mitigated
Denial of service or limited information disclosure if exploit attempts are detected and blocked.
🎯 Exploit Status
Public proof-of-concept code exists in GitHub repositories. The vulnerability appears to be remotely exploitable without authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: No official vendor advisory found
Restart Required: Yes
Instructions:
1. Check Tenda's official website for firmware updates
2. If available, download the latest firmware
3. Log into router admin interface
4. Navigate to System Tools > Firmware Upgrade
5. Upload and install the new firmware
6. Reboot the router
🔧 Temporary Workarounds
Disable remote management
allPrevent external access to the router's management interface
Network segmentation
allIsolate the router from critical internal networks
🧯 If You Can't Patch
- Replace the vulnerable device with a different model or vendor
- Implement strict network access controls to limit exposure to the device
🔍 How to Verify
Check if Vulnerable:
Check router firmware version via admin interface at 192.168.0.1 or 192.168.1.1, navigate to System Status or About pageCheck Version:
No CLI command available - check via web interfaceVerify Fix Applied:
Verify firmware version is no longer v15.03.05.09_multi after update📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to router management interface
- Multiple failed exploit attempts in logs
- Unexpected reboots or configuration changes
Network Indicators:
- Unusual traffic patterns to/from router on port 80/443
- Suspicious payloads in HTTP requests to router
SIEM Query:
source="router_logs" AND (uri_path="/goform/saveParentControlInfo" OR message="stack overflow" OR message="segmentation fault")