CVE-2022-40843

medium · 4.9

A public exploit / detection template exists

Weaponised detection is publicly available, which meaningfully raises real-world risk regardless of CVSS. nuclei-templates →

The Tenda AC1200 V-W15Ev2 V15.11.0.10(1576) router is vulnerable to improper authorization / improper session management that allows the router login page to be bypassed. This leads to authenticated attackers having the ability to read the routers syslog.log file which contains the MD5 password of the Administrator's user account.

4.9

CVSS

28.8%

EPSS (exploit prob.)

98th

EPSS percentile

2022-11-15

Published

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Affected products

Vendor	Product	Affected versions
tenda	w15e_firmware	15.11.0.10(1576)
tenda	w15e	2.0

Check a specific version with /api/v1/cve/match.

References

https://boschko.ca/tenda_ac1200_router/
https://boschko.ca/tenda_ac1200_router/

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2022-40843