CVE-2022-28971
📋 TL;DR
This vulnerability is a stack overflow in Tenda AX1806 routers via the list parameter in the fromSetIpMacBind function. Attackers can exploit this to cause a Denial of Service (DoS) by crashing the device. Only Tenda AX1806 v1.0.0.1 users are affected.
💻 Affected Systems
- Tenda AX1806
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete device crash requiring physical reboot, potentially disrupting all network connectivity for connected devices.
Likely Case
Router becomes unresponsive, requiring manual reboot to restore functionality.
If Mitigated
If properly segmented and not internet-facing, impact limited to local network disruption.
🎯 Exploit Status
Exploit requires authentication to the router's web interface. Public PoC exists in GitHub repository.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check Tenda website for latest firmware > v1.0.0.1
Vendor Advisory: Not specified in references
Restart Required: Yes
Instructions:
1. Log into Tenda router admin interface. 2. Navigate to System Tools > Firmware Upgrade. 3. Download latest firmware from Tenda website. 4. Upload and install firmware. 5. Router will reboot automatically.
🔧 Temporary Workarounds
Disable IP-MAC Binding Feature
allTemporarily disable the vulnerable IP-MAC binding functionality until patch can be applied.
Restrict Admin Interface Access
allLimit access to router admin interface to trusted IP addresses only.
🧯 If You Can't Patch
- Replace affected router with different model or vendor
- Implement network segmentation to isolate router from critical systems
🔍 How to Verify
Check if Vulnerable:
Check router firmware version in admin interface under System Status or Firmware Version.Check Version:
No CLI command; check via web interface at http://router_ipVerify Fix Applied:
Verify firmware version is updated to version higher than v1.0.0.1.📡 Detection & Monitoring
Log Indicators:
- Multiple failed authentication attempts followed by large POST requests to fromSetIpMacBind endpoint
- Router crash/reboot logs
Network Indicators:
- Unusual HTTP POST requests to router admin interface with large list parameters
- Router becoming unresponsive to ping
SIEM Query:
source="router_logs" AND (uri="/goform/setIpMacBind" OR process="crash")