CVE-2022-28973
📋 TL;DR
A stack overflow vulnerability exists in Tenda AX1806 routers via the wanMTU parameter in the fromAdvSetMacMtuWan function. Attackers can exploit this to cause a Denial of Service (DoS) by crashing the device. This affects users of Tenda AX1806 routers with vulnerable firmware.
💻 Affected Systems
- Tenda AX1806
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete device crash requiring physical reboot, potentially allowing remote code execution if the overflow can be controlled to execute arbitrary code.
Likely Case
Denial of Service causing router reboot and network disruption for connected devices.
If Mitigated
Limited to DoS with no persistence if proper network segmentation and access controls are in place.
🎯 Exploit Status
Exploitation requires authentication to the router's web interface. The vulnerability is in a parameter that can be manipulated via HTTP requests.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Not publicly available
Restart Required: Yes
Instructions:
1. Check Tenda's official website for firmware updates. 2. Download the latest firmware for AX1806. 3. Access router web interface. 4. Navigate to System Tools > Firmware Upgrade. 5. Upload and install the new firmware. 6. Wait for router to reboot.
🔧 Temporary Workarounds
Disable Remote Management
allPrevent external access to the router's web management interface.
Network Segmentation
allIsolate the router management interface to a dedicated VLAN with restricted access.
🧯 If You Can't Patch
- Restrict access to the router's management interface to trusted IP addresses only.
- Monitor for unusual HTTP requests to the router's web interface, particularly to fromAdvSetMacMtuWan endpoint.
🔍 How to Verify
Check if Vulnerable:
Check router firmware version via web interface: System Status > Firmware Version. If version is v1.0.0.1, device is vulnerable.Check Version:
curl -s http://router-ip/goform/getStatus | grep versionVerify Fix Applied:
After updating firmware, verify the version is no longer v1.0.0.1. Test by attempting to send malformed wanMTU parameter to confirm the overflow no longer occurs.📡 Detection & Monitoring
Log Indicators:
- Router crash/reboot logs
- Multiple failed authentication attempts followed by HTTP requests to fromAdvSetMacMtuWan
Network Indicators:
- HTTP POST requests to /goform/fromAdvSetMacMtuWan with unusually large wanMTU parameter values
SIEM Query:
source="router_logs" AND (event="crash" OR event="reboot") OR http_uri="/goform/fromAdvSetMacMtuWan" AND http_param="wanMTU" AND http_param_size>100