PT-2022-27713 · Tenda · Tenda W20E

Published 2022-12-12 · Updated 2025-04-22 · CVE-2022-45996

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Tenda W20E version 16.01.0.6(3392)

Description The issue is related to command injection via cmd get ping output.

Recommendations For Tenda W20E version 16.01.0.6(3392), consider restricting access to the cmd get ping output command until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2022-45996

Affected Products

Tenda W20E

References · 6

• 🔥❌ https://github.com/bugfinder0/public_bug/tree/main/tenda/w20e/2 · Exploit, Deleted
• https://osv.dev/vulnerability/CVE-2022-45996 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-45996 · Security Note
• https://t.me/cvenotify/39888 · Telegram Post
• https://t.me/cibsecurity/54332 · Telegram Post
• https://t.me/cvenotify/119437 · Telegram Post