exploitDog

CVE-2024-46437

Опубликовано: 10 фев. 2025

Источник: nvd

CVSS3: 6.5

EPSS Низкий

Описание

A sensitive information disclosure vulnerability in the Tenda W18E V16.01.0.8(1625) web management portal allows an unauthenticated remote attacker to retrieve sensitive configuration information, including WiFi SSID, WiFi password, and base64-encoded administrator credentials, by sending a specially crafted HTTP POST request to the getQuickCfgWifiAndLogin function, bypassing authentication checks.

Ссылки

https://reddassolutions.com/blog/tenda_w18e_security_research
Exploit
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одновременно

cpe:2.3:o:tenda:w18e_firmware:16.01.0.8\(1625\):*:*:*:*:*:*:*

cpe:2.3:h:tenda:w18e:-:*:*:*:*:*:*:*

EPSS

Процентиль: 66%

0.00515

Низкий

6.5 Medium

CVSS3

Дефекты

CWE-200

Связанные уязвимости

GHSA-gr7g-jpwx-6xrq

CVSS3: 8

github

12 месяцев назад

A sensitive information disclosure vulnerability in the Tenda W18E V16.01.0.8(1625) web management portal allows an unauthenticated remote attacker to retrieve sensitive configuration information, including WiFi SSID, WiFi password, and base64-encoded administrator credentials, by sending a specially crafted HTTP POST request to the getQuickCfgWifiAndLogin function, bypassing authentication checks.

EPSS

Процентиль: 66%

0.00515

Низкий

6.5 Medium

CVSS3

Дефекты

CWE-200