CVE-2022-28557
📋 TL;DR
This CVE describes a command injection vulnerability in Tenda AC15 routers that allows attackers to execute arbitrary commands on the device. When combined with CVE-2021-44971, it enables unconditional remote code execution. Users of affected Tenda AC15 router firmware versions are at risk.
💻 Affected Systems
- Tenda AC15 router
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete device compromise leading to router takeover, network traffic interception, credential theft, and lateral movement into connected networks.
Likely Case
Router compromise allowing attackers to modify network settings, intercept traffic, or use the device as a pivot point for further attacks.
If Mitigated
Limited impact if device is behind firewall with restricted web interface access and proper network segmentation.
🎯 Exploit Status
Exploit requires authentication to the web interface, but combined with CVE-2021-44971 authentication bypass makes it unauthenticated RCE.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Not found in provided references
Restart Required: Yes
Instructions:
1. Check Tenda website for firmware updates
2. Download latest firmware for AC15
3. Access router web interface
4. Navigate to firmware upgrade section
5. Upload and apply new firmware
6. Reboot router
🔧 Temporary Workarounds
Disable remote management
allPrevent external access to router web interface
Restrict web interface access
linuxUse firewall rules to limit access to router management interface
iptables -A INPUT -p tcp --dport 80 -s trusted_ip -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
🧯 If You Can't Patch
- Replace affected Tenda AC15 router with different model or vendor
- Place router behind dedicated firewall with strict access controls
🔍 How to Verify
Check if Vulnerable:
Check router firmware version in web interface under System Status or About pageCheck Version:
curl -s http://router-ip/goform/getStatus | grep versionVerify Fix Applied:
Verify firmware version is newer than US_AC15V1.0BR_V15.03.05.20_multi_TDE01.bin📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to /goform/setsambacfg
- Command execution patterns in system logs
- Unexpected process creation
Network Indicators:
- Unusual outbound connections from router
- Traffic to unexpected destinations
- Port scanning originating from router
SIEM Query:
source="router.log" AND (uri="/goform/setsambacfg" OR command="*;*" OR command="*|*")