PT-2025-6094 · Tenda · Tenda W18E

Matthew Evans · Published 2025-02-10 · Updated 2025-02-14 · CVE-2024-46436

Positive Technologies (AI Summary)

CVSS v3.1

8.3

High

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

Name of the Vulnerable Software and Affected Versions Tenda W18E version V16.01.0.8(1625)

Description The issue concerns hardcoded credentials in the Tenda W18E device, allowing unauthenticated remote attackers to gain root access to the device over the telnet service. This enables attackers to access the device without proper authentication, potentially leading to unauthorized control and data breaches.

Recommendations For Tenda W18E version V16.01.0.8(1625), consider disabling the telnet service until a patch is available to prevent exploitation of the hardcoded credentials. Additionally, restricting access to the device and implementing strong authentication mechanisms can help minimize the risk of unauthorized access. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

BDU:2025-04851

CVE-2024-46436

Affected Products

Tenda W18E

References · 9

• 🔥 https://reddassolutions.com/blog/tenda_w18e_security_research · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-46436 · Security Note
• https://osv.dev/vulnerability/CVE-2024-46436 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-04851 · Security Note
• https://twitter.com/CVEnew/status/1889032558504972459 · Twitter Post
• https://t.me/cvedetector/17582 · Telegram Post
• https://twitter.com/cybercronai/status/1889762758687670391 · Twitter Post
• https://twitter.com/cracbot/status/1890355519459844542 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1889066430974284008 · Twitter Post