PT-2022-25577 · Tenda · Tenda Ac1200 Router

Olivier Laflamme · Published 2022-11-15 · Updated 2023-01-27 · CVE-2022-40846

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Tenda AC1200 Router version 15.11.0.10(1576)

Description A Stored Cross Site Scripting (XSS) issue exists, allowing an attacker to execute JavaScript code via the application's stored hostname. This enables the attacker to potentially manipulate the application's behavior or steal sensitive information.

Recommendations For Tenda AC1200 Router version 15.11.0.10(1576), consider restricting access to the hostname storage functionality until a patch is available. As a temporary workaround, avoid using the stored hostname feature to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-40846

Affected Products

Tenda Ac1200 Router

References · 4

• 🔥 https://boschko.ca/tenda_ac1200_router · Exploit
• https://osv.dev/vulnerability/CVE-2022-40846 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-40846 · Security Note
• https://t.me/cvenotify/42951 · Telegram Post