Medium severity · published Nov 15, 2022
CVE-2022-40843
The Tenda AC1200 V-W15Ev2 V15.11.0.10(1576) router is vulnerable to improper authorization / improper session management that allows the router login page to be bypassed
4.9
CVSS
28.8%
EPSS
No
On KEV
Description
The Tenda AC1200 V-W15Ev2 V15.11.0.10(1576) router is vulnerable to improper authorization / improper session management that allows the router login page to be bypassed. This leads to authenticated attackers having the ability to read the routers syslog.log file which contains the MD5 password of the Administrator's user account.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)28.8% · higher than 98% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WF
W15e Firmware · Tenda
15.11.0.10(1576) · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-40843
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-40843
Exploit
https://boschko.ca/tenda_ac1200_router/
More from W15e Firmware
9.8
CVE-2023-27063
Tenda V15V1.0 V15.11.0.14(1521_3190_1058) was discovered to contain a buffer overflow vulnerability via the DNSDomainName parameter in the formModifyDnsForward function
9.8
CVE-2023-27061
Tenda V15V1.0 V15.11.0.14(1521_3190_1058) was discovered to contain a buffer overflow vulnerability via the wifiFilterListRemark parameter in the modifyWifiFilterRules function
9.8
CVE-2022-42058
Tenda AC1200 Router Model W15Ev2 V15.11.0.10(1576) was discovered to contain a stack overflow via the setRemoteWebManage function
8.8
CVE-2024-4127
A vulnerability was found in Tenda W15E 15.11.0.14
8.8
CVE-2024-4126
A vulnerability was found in Tenda W15E 15.11.0.14 and classified as critical