PT-2025-6095 · Tenda · Tenda W18E

Published 2025-02-10 · Updated 2025-02-12 · CVE-2024-46437

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Tenda W18E version V16.01.0.8(1625)

Description A sensitive information disclosure issue in the web management portal allows an unauthenticated remote attacker to retrieve sensitive configuration information, including WiFi SSID, WiFi password, and base64-encoded administrator credentials, by sending a specially crafted HTTP POST request to the getQuickCfgWifiAndLogin function, bypassing authentication checks.

Recommendations For Tenda W18E version V16.01.0.8(1625), as a temporary workaround, consider disabling the getQuickCfgWifiAndLogin function until a patch is available. Restrict access to the web management portal to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2024-46437

Affected Products

Tenda W18E

References · 7

• 🔥 https://reddassolutions.com/blog/tenda_w18e_security_research · Exploit
• https://osv.dev/vulnerability/CVE-2024-46437 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-46437 · Security Note
• https://twitter.com/VulmonFeeds/status/1889063870976647200 · Twitter Post
• https://t.me/cvedetector/17583 · Telegram Post
• https://twitter.com/cybercronai/status/1889766907823161441 · Twitter Post
• https://twitter.com/CVEnew/status/1889032559339724930 · Twitter Post