PT-2022-25574 · Tenda · Tenda Ac1200

Olivier Laflamme · Published 2022-11-15 · Updated 2023-08-08 · CVE-2022-40843

Positive Technologies (AI Summary)

CVSS v3.1

4.9

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Tenda AC1200 V-W15Ev2 version V15.11.0.10(1576)

Description The issue concerns improper authorization and improper session management, allowing the router login page to be bypassed. This enables authenticated attackers to read the router's syslog.log file, which contains the MD5 password of the Administrator's user account.

Recommendations For version V15.11.0.10(1576), consider restricting access to the syslog.log file to prevent unauthorized reading of the Administrator's password. As a temporary workaround, restrict access to the router's login page to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CVE-2022-40843

Affected Products

Tenda Ac1200

References · 5

• 🔥 https://boschko.ca/tenda_ac1200_router · Exploit
• https://osv.dev/vulnerability/CVE-2022-40843 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-40843 · Security Note
• https://t.me/cvenotify/42955 · Telegram Post
• https://t.me/cvenotify/37724 · Telegram Post