CVE-2022-25438

Tenda AC9 v15.03.2.21 was discovered to contain a remote command execution (RCE) vulnerability via the SetIPTVCfg function

published March 18, 2022

CVSS
—
EPSS
5%
Percentile
92.1
In the wild
Unconfirmed
What it is

🚨 A sneaky remote command execution vulnerability lurks in Tenda AC9 routers! This means attackers could potentially control your device with just a clever command. 🔥 Think of it like a hotel receptionist who lets anyone into your room just by saying the right words. With this vulnerability, bad actors can issue commands that the router will obediently follow, opening the door to all kinds of mischief. If exploited, an attacker could gain complete control over the router, which could lead to unauthorized access to your network, data interception, or even the installation of malicious software. This could be absolutely devastating for both your personal information and network security!

Put simply

Think of it like a hotel receptionist who lets anyone into your room just by saying the right words. With this vulnerability, bad actors can issue commands that the router will obediently follow, opening the door to all kinds of mischief. The vulnerability exists in the SetIPTVCfg function, allowing attackers to execute arbitrary commands remotely without proper authentication, effectively hijacking the router's operation.

What to do

If exploited, an attacker could gain complete control over the router, which could lead to unauthorized access to your network, data interception, or even the installation of malicious software. This could be absolutely devastating for both your personal information and network security! To protect yourself, patch the router to the latest firmware version as soon as it's available. It's also a good idea to change any default passwords and ensure your network settings are secure. Regularly check for updates to stay protected! You’ve got this! Follow these steps, and your router will be secure in no time. 🛡️

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.04947 · 92.1th percentile
Published
2022-03-18T20:53Z
EPSS history
Timeline
  • 18 MAR 20:53Z
    Tenda AC9 v15.03.2.21 was discovered to contain a remote command execution (RCE) vulnerability via the SetIPTVCfg function
    cvelistv5