CVE-2022-28561: Tenda AX12 Firmware

Critical severity, CVSS 9.8. EPSS: 10.1% chance of exploitation in the next 30 days.

There is a stack overflow vulnerability in the /goform/setMacFilterCfg function in the httpd service of Tenda ax12 22.03.01.21_cn router. An attacker can obtain a stable shell through a carefully constructed payload

Affected products

• Tenda AX12 Firmware: version 22.03.01.21_cn only

Published 2022-05-03. Last modified 2026-06-17.