CVE-2021-44971
CriticalCVSS 9.8Exploitation Probability (EPSS)
High risk79th percentile - higher than 79% of all known CVEs
Summary
Multiple Tenda devices are vulnerable to authentication bypass, allowing an attacker to obtain sensitive information. This vulnerability can be combined with authenticated command injection to achieve remote code execution (RCE).
Risk Assessment
The risk includes leakage of confidential data and potential takeover of the device by an attacker, which could lead to further attacks within the network.
Recommendation
It is recommended to immediately update the firmware of Tenda devices to the latest version and implement additional authentication mechanisms.
Original NVD description (English source)
Multiple Tenda devices are affected by authentication bypass, such as AC15V1.0 Firmware V15.03.05.20_multi?AC5V1.0 Firmware V15.03.06.48_multi and so on. an attacker can obtain sensitive information, and even combine it with authenticated command injection to implement RCE.