CVE-2022-31446
📋 TL;DR
This vulnerability allows remote attackers to execute arbitrary code on Tenda AC18 routers by sending specially crafted requests to the Mac parameter at ip/goform/WriteFacMac. Attackers can gain full control of affected routers without authentication. Users running vulnerable firmware versions are affected.
💻 Affected Systems
- Tenda AC18
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete router compromise allowing attackers to intercept all network traffic, install persistent malware, pivot to internal networks, and use the router for botnet activities.
Likely Case
Router takeover leading to DNS hijacking, credential theft from network traffic, and installation of cryptocurrency miners or other malware.
If Mitigated
Limited impact if routers are behind firewalls with strict inbound filtering and network segmentation.
🎯 Exploit Status
Public proof-of-concept available on GitHub. Exploitation requires sending HTTP POST request with malicious payload to vulnerable endpoint.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: V15.03.05.20 or later
Vendor Advisory: https://www.tendacn.com/en/
Restart Required: Yes
Instructions:
1. Log into router admin interface. 2. Navigate to System Tools > Firmware Upgrade. 3. Download latest firmware from Tenda website. 4. Upload and install firmware. 5. Reboot router after installation.
🔧 Temporary Workarounds
Disable Remote Management
allPrevents external access to router admin interface
Network Segmentation
allIsolate router management interface to separate VLAN
🧯 If You Can't Patch
- Replace affected routers with patched or different models
- Implement strict firewall rules blocking all inbound traffic to router management interfaces
🔍 How to Verify
Check if Vulnerable:
Check router firmware version in admin interface under System Status or System ToolsCheck Version:
curl -s http://router-ip/goform/version or check web interfaceVerify Fix Applied:
Confirm firmware version is V15.03.05.20 or later after patching📡 Detection & Monitoring
Log Indicators:
- HTTP POST requests to /goform/WriteFacMac with unusual Mac parameter values
- Unusual process execution in router logs
Network Indicators:
- Unusual outbound connections from router
- DNS queries to suspicious domains
- Unexpected SSH/Telnet access
SIEM Query:
source="router_logs" AND (uri_path="/goform/WriteFacMac" OR process="malicious_payload")