PT-2022-12274 · Tenda · Tenda Ac5+1

21Gun5 · Published 2022-01-28 · Updated 2024-02-14 · CVE-2021-44971

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Tenda devices, such as AC15V1.0 version V15.03.05.20 multi and AC5V1.0 version V15.03.06.48 multi

Description The issue allows an attacker to bypass authentication, potentially obtaining sensitive information. This can be combined with authenticated command injection to implement remote code execution (RCE).

Recommendations For Tenda AC15V1.0 version V15.03.05.20 multi, update to a version that addresses the authentication bypass issue. For Tenda AC5V1.0 version V15.03.06.48 multi, update to a version that addresses the authentication bypass issue. As a temporary workaround, consider restricting access to sensitive information and limiting command injection capabilities until a patch is available.

Exploit

Fix

Weakness Enumeration

CWE-697

Related Identifiers

CVE-2021-44971

Affected Products

Tenda Ac15

Tenda Ac5

References · 7

• 🔥 https://github.com/21Gun5/my_cve/blob/main/tenda/bypass_auth.md · Exploit
• http://tenda.com · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-44971 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-44971 · Security Note
• https://t.me/cvenotify/29694 · Telegram Post
• https://t.me/cibsecurity/41942 · Telegram Post
• http://ac15v10.com · Note