CVE-2022-28557: OS Command Injection

Published May 4, 2022

Updated

There is a command injection vulnerability at the /goform/setsambacfg interface of Tenda AC15 USAC15V1.0BRV15.03.05.20multiTDE01.bin device web, which can also cooperate with CVE-2021-44971 to cause unconditional arbitrary command execution

Affected Software

2 affected components

Tenda ac15 firmware=15.03.05.20_multi_tde01

Tenda Ac15=1.0

Event History

May 4, 2022

CVE Published

via MITRE·03:18 PM

Data Sourced

via MITRE·03:18 PM

Description

Frequently Asked Questions

What is the severity of CVE-2022-28557?

The severity of CVE-2022-28557 is critical with a severity value of 9.8.

What is CVE-2022-28557?

CVE-2022-28557 is a command injection vulnerability at the /goform/setsambacfg interface of Tenda AC15 US_AC15V1.0BR_V15.03.05.20_multi_TDE01.bin device web, which can also cooperate with CVE-2021-44971 to cause unconditional arbitrary command execution.

How does CVE-2022-28557 affect Tenda AC15?

CVE-2022-28557 affects Tenda AC15 with firmware version 15.03.05.20_multi_tde01, allowing for command injection at the /goform/setsambacfg interface.

Is Tenda AC15 version 1.0 vulnerable to CVE-2022-28557?

No, Tenda AC15 version 1.0 is not vulnerable to CVE-2022-28557.

How can I fix CVE-2022-28557?

To fix CVE-2022-28557, it is recommended to update the firmware of Tenda AC15 to a version that addresses the vulnerability.