CVE-2022-45980

The Tenda AX12 router has a flaw that allows attackers to trick users into performing unwanted actions on their router settings through malicious websites. An attacker can force a user to restore the router to default settings without their knowledge.

A Cross-Site Request Forgery (CSRF) vulnerability exists in the /goform/SysToolRestoreSet endpoint of Tenda AX12 V22.03.01.21_CN. The vulnerability permits an unauthenticated attacker to forge requests that execute system restore operations by tricking an authenticated router administrator into visiting a malicious website, resulting in potential loss of router configuration and security posture.