CVE-2022-31446: Tenda AC18 Firmware RCE Vulnerability

CVE-2022-31446 Overview

CVE-2022-31446 is a remote code execution (RCE) vulnerability affecting the Tenda AC18 router firmware. The vulnerability exists in the WriteFacMac function accessible via the /goform/WriteFacMac endpoint, where the Mac parameter is improperly sanitized before being passed to system commands. This command injection flaw (CWE-78) allows unauthenticated remote attackers to execute arbitrary operating system commands on the affected device with root privileges.

Critical Impact

Unauthenticated attackers can remotely execute arbitrary commands on vulnerable Tenda AC18 routers, potentially leading to complete device compromise, network infiltration, and persistent backdoor installation.

Affected Products

• Tenda AC18 Router Firmware V15.03.05.19
• Tenda AC18 Router Firmware V15.03.05.05
• Tenda AC18 Hardware Device

Discovery Timeline

• 2022-06-14 - CVE-2022-31446 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2022-31446

Vulnerability Analysis

This vulnerability is classified as a command injection flaw (CWE-78: Improper Neutralization of Special Elements used in an OS Command). The Tenda AC18 router's web management interface exposes an endpoint at /goform/WriteFacMac that processes user-supplied MAC address values. The Mac parameter submitted to this endpoint is not properly validated or sanitized before being incorporated into system-level commands executed on the underlying Linux-based operating system.

The attack requires no authentication and can be performed remotely over the network. An attacker who can reach the router's web management interface can craft malicious requests containing shell metacharacters or command separators within the Mac parameter. These injected commands are then executed with the privileges of the web server process, which typically runs as root on embedded devices like the Tenda AC18.

Successful exploitation grants attackers complete control over the router, enabling them to intercept network traffic, modify DNS settings, establish persistent backdoors, or pivot to attack other devices on the internal network.

Root Cause

The root cause of CVE-2022-31446 is insufficient input validation in the WriteFacMac function. The firmware fails to properly sanitize the Mac parameter before passing it to shell commands. Special characters such as semicolons (;), pipes (|), backticks (`), and command substitution sequences ($()) are not filtered, allowing attackers to break out of the intended command context and inject arbitrary commands.

This is a common vulnerability pattern in embedded device firmware where user input is concatenated directly into system calls without proper escaping or validation.

Attack Vector

The attack is performed over the network against the router's HTTP-based management interface. An attacker sends a crafted HTTP POST request to the /goform/WriteFacMac endpoint with a malicious payload in the Mac parameter. The payload typically includes command injection sequences that execute attacker-controlled commands.

For example, an attacker could inject shell commands by including metacharacters like ;, |, or $(command) within the Mac parameter value. Since the router runs with root privileges, any injected commands execute with full administrative access to the device.

Technical details and proof-of-concept information are available in the GitHub RCE PoC Repository.

Detection Methods for CVE-2022-31446

Indicators of Compromise

• Unexpected HTTP POST requests to /goform/WriteFacMac endpoint from external IP addresses
• Presence of shell metacharacters (;, |, `, $()) in web server access logs for the Mac parameter
• Unusual outbound connections from the router to unknown external hosts
• Modified router configuration files or unexpected scheduled tasks (cron jobs)
• New user accounts or SSH keys added to the router

Detection Strategies

• Monitor HTTP traffic to the router's management interface for requests containing suspicious characters in POST parameters
• Implement network intrusion detection rules to flag POST requests to /goform/WriteFacMac with anomalous payload patterns
• Review router access logs for repeated attempts to access administrative endpoints from untrusted sources
• Deploy network behavioral analysis to detect command-and-control communication patterns originating from the router

Monitoring Recommendations

• Isolate router management interfaces from untrusted networks and the public internet
• Enable logging on the router if supported and forward logs to a centralized SIEM for analysis
• Monitor for DNS configuration changes or unexpected traffic routing through the affected device
• Conduct periodic firmware integrity checks to detect unauthorized modifications

How to Mitigate CVE-2022-31446

Immediate Actions Required

• Restrict access to the router's web management interface to trusted internal networks only
• Disable remote management features if not explicitly required
• Implement firewall rules to block external access to ports 80 and 443 on the router
• Consider replacing vulnerable devices with routers from vendors with active security update programs
• Monitor network traffic for signs of exploitation or compromise

Patch Information

At the time of publication, no official security patch from Tenda has been identified for CVE-2022-31446. Organizations using affected Tenda AC18 routers should check the Tenda support portal for firmware updates and apply any available security patches immediately.

Given the lack of confirmed patches and the critical nature of this vulnerability, organizations should prioritize network segmentation and access controls as compensating measures.

Workarounds

• Disable the web-based management interface entirely and use serial console access for administration if possible
• Place the router behind a properly configured firewall that blocks access to the management interface from untrusted networks
• Implement network segmentation to limit the impact of a potential router compromise
• Consider deploying an alternative router with an active security maintenance program if patches are not available

# Example iptables rules to restrict management interface access
# Apply these on an upstream firewall device

# Block external access to router management on port 80
iptables -A FORWARD -d <ROUTER_IP> -p tcp --dport 80 -j DROP

# Block external access to router management on port 443
iptables -A FORWARD -d <ROUTER_IP> -p tcp --dport 443 -j DROP

# Allow only trusted admin subnet to access management interface
iptables -I FORWARD -s <TRUSTED_ADMIN_SUBNET> -d <ROUTER_IP> -p tcp --dport 80 -j ACCEPT
iptables -I FORWARD -s <TRUSTED_ADMIN_SUBNET> -d <ROUTER_IP> -p tcp --dport 443 -j ACCEPT