CVE-2022-25441: OS Command Injection
Published Mar 18, 2022
·Updated
Tenda AC9 v15.03.2.21 was discovered to contain a remote command execution (RCE) vulnerability via the vlanid parameter in the SetIPTVCfg function.
Affected Software
2 affected components
Tenda Ac9 Firmware=15.03.2.21
Tenda Ac9
Event History
Mar 18, 2022
CVE Published
via MITRE·08:53 PM
Data Sourced
via MITRE·08:53 PM
Description
Frequently Asked Questions
1
What is CVE-2022-25441?
CVE-2022-25441 is a remote command execution (RCE) vulnerability in Tenda AC9 v15.03.2.21 via the vlanid parameter in the SetIPTVCfg function.
2
How severe is CVE-2022-25441?
CVE-2022-25441 has a severity rating of 9.8 (Critical).
3
How does CVE-2022-25441 affect Tenda AC9 v15.03.2.21?
CVE-2022-25441 allows remote attackers to execute arbitrary commands on Tenda AC9 v15.03.2.21 by exploiting the vulnerability in the vlanid parameter of the SetIPTVCfg function.
4
Is Tenda AC9 v15.03.2.21 the only affected version?
Yes, Tenda AC9 v15.03.2.21 is the only affected version.
5
How can I fix CVE-2022-25441?
To fix CVE-2022-25441, it is recommended to update Tenda AC9 firmware to a version that addresses the vulnerability.