PT-2022-25843 · Tenda · Tenda Ac1200 Router

Olivier Laflamme · Published 2022-11-15 · Updated 2023-01-23 · CVE-2022-41396

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Tenda AC1200 Router Model W15Ev2 version V15.11.0.10(1576)

Description The issue concerns multiple command injection vulnerabilities found in the function setIPsecTunnelList. These vulnerabilities can be exploited via the IPsecLocalNet and IPsecRemoteNet parameters.

Recommendations For Tenda AC1200 Router Model W15Ev2 version V15.11.0.10(1576), as a temporary workaround, consider restricting access to the setIPsecTunnelList function until a patch is available. Avoid using the IPsecLocalNet and IPsecRemoteNet parameters in the affected function to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2022-41396

Affected Products

Tenda Ac1200 Router

References · 4

• 🔥 https://boschko.ca/tenda_ac1200_router · Exploit
• https://osv.dev/vulnerability/CVE-2022-41396 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-41396 · Security Note
• https://t.me/cvenotify/42700 · Telegram Post