CVE-2023-49428
📋 TL;DR
This CVE describes a command injection vulnerability in Tenda AX12 routers where an attacker can execute arbitrary commands via the 'mac' parameter in the SetOnlineDevName endpoint. Attackers with network access to the router can exploit this to gain full control of the device. All users of affected Tenda AX12 routers are at risk.
💻 Affected Systems
- Tenda AX12
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Full remote code execution leading to complete router compromise, credential theft, network traffic interception, and lateral movement into connected devices.
Likely Case
Router takeover allowing DNS hijacking, credential harvesting, and installation of persistent malware on the router.
If Mitigated
Limited impact if router is behind firewall with restricted WAN access and strong network segmentation.
🎯 Exploit Status
Public proof-of-concept available on GitHub. Exploitation requires sending a crafted HTTP POST request to the vulnerable endpoint.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Not available
Restart Required: Yes
Instructions:
1. Check Tenda website for firmware updates
2. Download latest firmware for AX12
3. Access router admin panel
4. Navigate to firmware update section
5. Upload and apply new firmware
6. Reboot router after update
🔧 Temporary Workarounds
Disable Remote Management
allPrevent external access to router management interface
Network Segmentation
allIsolate router management interface to trusted network segment only
🧯 If You Can't Patch
- Replace affected router with different model/brand
- Place router behind dedicated firewall with strict inbound rules
🔍 How to Verify
Check if Vulnerable:
Check router firmware version in admin panel. If version is V22.03.01.46, device is vulnerable.Check Version:
curl -s http://router-ip/goform/getStatus | grep versionVerify Fix Applied:
Verify firmware version has been updated to a version later than V22.03.01.46📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to /goform/SetOnlineDevName
- Commands with shell metacharacters in 'mac' parameter
- Unexpected process execution in router logs
Network Indicators:
- HTTP POST requests to /goform/SetOnlineDevName with shell commands in parameters
- Unusual outbound connections from router
SIEM Query:
source="router_logs" AND (uri="/goform/SetOnlineDevName" OR (parameter="mac" AND value MATCHES "[;&|`$()]"))