PT-2021-11759 · Tenda · Tenda N300 F3

Published 2021-01-01 · Updated 2024-09-21 · CVE-2020-35391

Positive Technologies (AI Summary)

CVSS v3.1

9.6

Critical

Base vector

AC:L/AV:A/A:H/C:H/I:H/PR:N/S:C/UI:N

Name of the Vulnerable Software and Affected Versions: Tenda N300 F3 version 12.01.01.48

Description: The issue allows remote attackers to obtain sensitive information, possibly including an http passwd line, via a direct request for "cgi-bin/DownloadCfg/RouterCfm.cfg". The vulnerability may require a specific character, such as ?, to be placed after the RouterCfm.cfg filename, or unusual HTTP request headers, although the reason for this is not clear.

Recommendations: For Tenda N300 F3 version 12.01.01.48, as a temporary workaround, consider restricting access to the "cgi-bin/DownloadCfg/RouterCfm.cfg" endpoint until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Weakness Enumeration

CWE-425

Related Identifiers

CVE-2020-35391

Affected Products

Tenda N300 F3

References · 11

• 🔥 https://github.com/H454NSec/CVE-2020-35391 · Exploit
• 🔥 https://exploit-db.com/exploits/51317 · Exploit
• 🔥 https://medium.com/@signalhilltech/tenda-n300-authentication-bypass-via-malformed-http-request-header-5b8744ca685e · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-35391 · Security Note
• https://osv.dev/vulnerability/CVE-2020-35391 · Vendor Advisory
• https://medium.com/%40signalhilltech/tenda-n300-authentication-bypass-via-malformed-http-request-header-5b8744ca685e · Note
• https://t.me/cibsecurity/21508 · Telegram Post
• https://t.me/freedomf0x/11344 · Telegram Post
• https://t.me/cvenotify/8080 · Telegram Post
• https://twitter.com/rst_cloud/status/1837592552209322421 · Twitter Post
• http://packetstormsecurity.com/files/171773/Tenda-N300-F3-12.01.01.48-Header-Processing.html · Note