CVE-2022-40844 in AC1200
Summary
by MITRE • 11/15/2022
In Tenda (Shenzhen Tenda Technology Co., Ltd) AC1200 Router model W15Ev2 V15.11.0.10(1576), a Stored Cross Site Scripting (XSS) issue exists allowing an attacker to execute JavaScript code via the applications website filtering tab, specifically the URL body.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 05/15/2025
The vulnerability identified as CVE-2022-40844 represents a critical stored cross site scripting flaw discovered in the Tenda AC1200 Router model W15Ev2 running firmware version 15.11.0.10(1576). This security weakness resides within the router's web-based administration interface, specifically within the website filtering tab functionality. The vulnerability stems from inadequate input validation and output encoding mechanisms that fail to properly sanitize user-supplied data before it is processed and stored within the router's configuration system. The flaw allows an attacker to inject malicious JavaScript code through the URL parameter handling within the website filtering section, creating a persistent XSS vector that can affect all users who access the affected web interface.
The technical exploitation of this vulnerability occurs when an attacker crafts a malicious URL containing JavaScript code and submits it through the website filtering tab of the router's web interface. Due to insufficient sanitization of the URL parameter in the applications website filtering functionality, the malicious payload gets stored within the router's configuration database. When other users navigate to the website filtering section or when the router processes the stored URL data, the malicious JavaScript code executes within the context of the victim's browser session. This stored nature of the vulnerability means that the malicious code persists even after the initial injection, making it particularly dangerous as it can affect multiple users over extended periods without requiring repeated exploitation attempts.
The operational impact of CVE-2022-40844 extends beyond simple script execution, as it provides attackers with the capability to perform various malicious activities within the network environment. Attackers can leverage this vulnerability to steal session cookies, redirect users to malicious websites, modify router configurations, or even establish persistent backdoors within the network infrastructure. The severity of this flaw is amplified by the fact that routers serve as critical network gateways, making successful exploitation potentially devastating for network security. The vulnerability aligns with CWE-79 which describes Cross-site Scripting flaws, and specifically relates to CWE-80 which addresses improper neutralization of script in different contexts. From an ATT&CK framework perspective, this vulnerability maps to T1566.001 (Phishing via Social Media) and T1071.004 (Application Layer Protocol: DNS) as attackers can use the XSS to redirect traffic or harvest credentials, and to T1547.001 (Registry Run Keys / Startup Folder) if the attacker can modify router settings.
Mitigation strategies for CVE-2022-40844 should focus on immediate firmware updates from Tenda, as the vendor has likely released patches addressing this specific vulnerability. Network administrators should implement network segmentation and monitoring to detect unusual traffic patterns that might indicate exploitation attempts. Additionally, implementing web application firewalls and content security policies can help prevent malicious payloads from executing even if the vulnerability remains unpatched. The use of secure network protocols and disabling unnecessary web interfaces on routers can also reduce the attack surface. Organizations should conduct regular vulnerability assessments of their network infrastructure and ensure that all network devices receive timely security updates. The vulnerability demonstrates the importance of proper input validation and output encoding practices in network device web interfaces, as highlighted in industry standards such as OWASP Top Ten and NIST cybersecurity guidelines for embedded systems security.