High severity · published May 10, 2023
CVE-2023-30351
Shenzen Tenda Technology IP Camera CP3 V11.10.00.2211041355 was discovered to contain a hard-coded default password for root which is stored using weak encryption
7.5
CVSS
0.2%
EPSS
No
On KEV
Description
Shenzen Tenda Technology IP Camera CP3 V11.10.00.2211041355 was discovered to contain a hard-coded default password for root which is stored using weak encryption. This vulnerability allows attackers to connect to the TELNET service (or UART) by using the exposed credentials.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 15% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CF
Cp3 Firmware · Tenda
11.10.00.2211041355 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-30351
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-30351
Third Party Advisory
https://github.com/SECloudUNIMORE/ACES/blob/master/Tenda/CP3/tmp_PRA.md
Third Party Advisory
https://github.com/SECloudUNIMORE/ACES/blob/master/Tenda/CP3/tmp_RRA.md
More from Cp3 Firmware
10.0
CVE-2026-86152
Tenda CP3 Kylin AutoAddWifi.cpp ThreadProc os command injection
9.8
CVE-2023-30354
Shenzen Tenda Technology IP Camera CP3 V11.10.00.2211041355 does not defend against physical access to U-Boot via the UART: the Wi-Fi password is shown, and the hardcoded boot…
9.8
CVE-2023-30353
Shenzen Tenda Technology IP Camera CP3 V11.10.00.2211041355 allows unauthenticated remote code execution via an XML document
9.8
CVE-2023-30352
Shenzen Tenda Technology IP Camera CP3 V11.10.00.2211041355 was discovered to contain a hard-coded default password for the RTSP feed
9.8
CVE-2023-23080
Certain Tenda products are vulnerable to command injection