CVE-2023-49429
📋 TL;DR
CVE-2023-49429 is a SQL injection vulnerability in Tenda AX9 routers that allows attackers to execute arbitrary SQL commands through the 'mac' parameter in the setDeviceInfo feature. This affects all users running vulnerable firmware versions, potentially leading to complete device compromise. Attackers can exploit this without authentication to manipulate the router's database.
💻 Affected Systems
- Tenda AX9
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete router takeover leading to credential theft, network traffic interception, malware deployment, and pivot to internal network devices.
Likely Case
Router configuration manipulation, credential extraction, and denial of service through database corruption.
If Mitigated
Limited impact if network segmentation isolates the router and external access is blocked.
🎯 Exploit Status
Public proof-of-concept exists showing simple HTTP POST exploitation. No authentication required.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: No official vendor advisory found
Restart Required: Yes
Instructions:
1. Check Tenda website for firmware updates 2. Download latest firmware 3. Upload via web interface 4. Reboot router
🔧 Temporary Workarounds
Disable remote management
allPrevent external access to router web interface
Access router settings > Disable 'Remote Management' or 'Web Access from WAN'
Network segmentation
allIsolate router management interface from untrusted networks
Configure firewall rules to block external access to port 80/443 on router IP
🧯 If You Can't Patch
- Replace vulnerable router with patched alternative
- Implement strict network access controls and monitor for exploitation attempts
🔍 How to Verify
Check if Vulnerable:
Check firmware version in router web interface under System Status or About pageCheck Version:
curl -s http://router-ip/goform/getStatus | grep versionVerify Fix Applied:
Verify firmware version is newer than V22.03.01.46📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to /goform/setModules
- SQL error messages in logs
- Multiple failed authentication attempts
Network Indicators:
- HTTP requests with SQL injection patterns in 'mac' parameter
- Unexpected database queries from router
SIEM Query:
source="router_logs" AND (url="/goform/setModules" OR message="SQL" OR message="database")