CVE-2022-45980
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
The Tenda AX12 router has a flaw that allows attackers to trick users into performing unwanted actions on their router settings through malicious websites. An attacker can force a user to restore the router to default settings without their knowledge.
A Cross-Site Request Forgery (CSRF) vulnerability exists in the /goform/SysToolRestoreSet endpoint of Tenda AX12 V22.03.01.21_CN. The vulnerability permits an unauthenticated attacker to forge requests that execute system restore operations by tricking an authenticated router administrator into visiting a malicious website, resulting in potential loss of router configuration and security posture.