PT-2023-22358 · Tenda · Tenda N301

Published 2023-05-01 · Updated 2025-01-30 · CVE-2023-29681

Positive Technologies (AI Summary)

CVSS v3.1

5.7

Medium

Base vector

AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Tenda N301 version 6.0, firmware versions 12.02.01.61 multi through 12.03.01.06 pt

Description The issue allows an authenticated attacker on the LAN or WLAN to intercept communications with the router and obtain the password due to cleartext transmission in the ecos pw cookie.

Recommendations For Tenda N301 version 6.0, firmware versions 12.02.01.61 multi through 12.03.01.06 pt, consider restricting access to the router's administration interface to minimize the risk of exploitation until a patch is available. As a temporary workaround, avoid using the ecos pw cookie in the affected set-cookie endpoint until the issue is resolved.

Exploit

Fix

Cleartext Transmission of Sensitive Information

Weakness Enumeration

CWE-319

Related Identifiers

CVE-2023-29681

Affected Products

Tenda N301

References · 8

• 🔥 https://youtube.com/watch?v=Xy9_hmpvvA4&ab_channel=0ta · Exploit
• 🔥 https://medium.com/@0ta/tenda-n301-v6-cve-2023-29680-cve-2023-29681-a40f7ae6dc62 · Exploit
• https://osv.dev/vulnerability/CVE-2023-29681 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-29681 · Security Note
• https://t.me/cvenotify/49570 · Telegram Post
• https://medium.com/%400ta/tenda-n301-v6-cve-2023-29680-cve-2023-29681-a40f7ae6dc62 · Note
• https://t.me/cvenotify/109270 · Telegram Post
• https://t.me/cvenotify/109269 · Telegram Post