Medium severity · published Jan 1, 2021
CVE-2020-35391
Tenda N300 F3 12.01.01.48 devices allow remote attackers to obtain sensitive information (possibly including an http_passwd line) via a direct request for…
6.5
CVSS
35.2%
EPSS
No
On KEV
Description
Tenda N300 F3 12.01.01.48 devices allow remote attackers to obtain sensitive information (possibly including an http_passwd line) via a direct request for cgi-bin/DownloadCfg/RouterCfm.cfg, a related issue to CVE-2017-14942. NOTE: the vulnerability report may suggest that either a ? character must be placed after the RouterCfm.cfg filename, or that the HTTP request headers must be unusual, but it is not known why these are relevant to the device's HTTP response behavior.
CVSS vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Adjacent
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)35.2% · higher than 98% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FF
F3 Firmware · Tenda
12.01.01.48 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-35391
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-35391
packetstormsecurity.com
http://packetstormsecurity.com/files/171773/Tenda-N300-F3-12.01.01.48-Header-Processing.html
medium.com
https://medium.com/%40signalhilltech/tenda-n300-authentication-bypass-via-malformed-http-request-header-5b8744ca685e
More from F3 Firmware
6.5
CVE-2026-27514
Tenda F3 Plaintext Credential Exposure in Configuration Download
6.1
CVE-2026-27512
Tenda F3 Reflected Script Execution via Missing nosniff Header
5.6
CVE-2025-57571
Tenda F3 V12.01.01.48_multi and after is vulnerable to Buffer Overflow
5.6
CVE-2025-57572
Tenda F3 V12.01.01.48_multi and after is vulnerable to Buffer Overflow via the onlineList parameter in goform/setParentControl
5.6
CVE-2025-57573
Tenda F3 V12.01.01.48_multi and after is vulnerable to Buffer Overflow via the wifiTimeClose parameter in goform/setWifi