CVE-2022-28557

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 22.6% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2022-05-04 · updated 2026-06-17
Weakness: CWE-78

Description

There is a command injection vulnerability at the /goform/setsambacfg interface of Tenda AC15 US_AC15V1.0BR_V15.03.05.20_multi_TDE01.bin device web, which can also cooperate with CVE-2021-44971 to cause unconditional arbitrary command execution

Affected products

Tenda AC15: 15.03.05.20_multi_tde01

References

https://github.com/doudoudedi/TendaAC15_vul/blob/main/TendaAC15-vul.md
https://github.com/doudoudedi/TendaAC15_vul/blob/main/TendaAC15-vul.md

Get alerted when CVE-2022-28557 or the next vulnerability affects your stack