PT-2025-6091 · Tenda · Tenda W18E

Matthew Evans · CVE-2024-46433 · Published 2023-02-10 · Updated 2025-02-14

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Tenda W18E version V16.01.0.8(1625)

Description A default credentials vulnerability allows unauthenticated remote attackers to access the web management portal using the default rzadmin account with administrative privileges.

Recommendations For Tenda W18E version V16.01.0.8(1625), consider changing the default rzadmin account credentials to prevent unauthorized access. As a temporary workaround, restrict access to the web management portal until a patch is available.

Exploit

Fix

Using Hardcoded Credentials

Weakness Enumeration

CWE-1392

CWE-798

Related Identifiers

BDU:2025-02062

CVE-2024-46433

Affected Products

Tenda W18E

References · 10

• 🔥 https://reddassolutions.com/blog/tenda_w18e_security_research · Exploit
• https://bdu.fstec.ru/vul/2025-02062 · Security Note
• https://osv.dev/vulnerability/CVE-2024-46433 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-46433 · Security Note
• https://twitter.com/cybercronai/status/1889751968534388869 · Twitter Post
• https://t.me/cvedetector/17589 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1889076668666384537 · Twitter Post
• https://twitter.com/cracbot/status/1890355514598637829 · Twitter Post
• https://twitter.com/CVEnew/status/1889032556030349326 · Twitter Post
• https://vuldb.com/?id.295150 · Note