by Kastro
Paper/Archive/CVE-2020-35391

CVE-2020-35391

mitre — Tenda N300 F3 12.01.01.48 devices allow remote attackers to obtain sensitive information (possibly including an http_passwd line) via a d…

EPSS 35%CVSS 9.6
critical.is priorityof 100
49
CVSS 9.6 (CNA)9.6 / 10 × 3028.8Not in CISA KEV+300.0EPSS percentile 98.4.984 × 2019.7No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

Tenda N300 F3 12.01.01.48 devices allow remote attackers to obtain sensitive information (possibly including an http_passwd line) via a direct request for cgi-bin/DownloadCfg/RouterCfm.cfg, a related issue to CVE-2017-14942. NOTE: the vulnerability report may suggest that either a ? character must be placed after the RouterCfm.cfg filename, or that the HTTP request headers must be unusual, but it is not known why these are relevant to the device's HTTP response behavior.

Affected

ProductAffectedFixed inSource
n/an/a–CNA

Scores by source

mitre (CNA)9.6CVSS:3.1/AC:L/AV:A/A:H/C:H/I:H/PR:N/S:C/UI:N

References

refmedium.com/%40signalhilltech/tenda-n300-authentication-bypass-via-malformed-http-request-header-5b8744ca685erefpacketstormsecurity.com/files/171773/Tenda-N300-F3-12.01.01.48-Header-Processing.html